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Introduction 


This document describes procedures for using Wind River Workbench with the 
Wind River Probe and Wind River ICE emulators to bring up a target board, from 
the first power-up through running and debugging application code. 


This document includes the following chapters: 

1. Introduction - Introduces the document. 

2. On-Chip Debugging - Describes of the theory of on-chip debugging. 
3. Board Bring-Up - Provides an overview of board bring-up procedure. 


4, OCD Connections - Describes making an OCD connection to a target using a 
JTAG or BDM port. 


5. Tool Configuration - Describes hardware-specific configuration options for Wind 
River emulators. 


6. Board Initialization - Describes how to use Wind River emulators to initialize the 
target hardware. 


7. Verifying Hardware - Describes how to use Wind River Workbench to run 
hardware diagnostics on your target. 


8. Testing Memory - Describes how to use Wind River emulators to suspend CPU 
operations and force the target into background mode. 


9. Debugging in RAM - Describes how to create a project, download code and 
symbol information, set software breakpoints, and step through code. 


10. Programming Flash Memory - Describes working with flash memory on your 
target. 
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11. Debugging in ROM - Describes using hardware breakpoints to debug in ROM. 


A. Pins Mapped to Common Signals - Provides a mapping reference for Wind 
River-supported processor families. 


B. Internal Breakpoint Capabilities - Provides a detailed reference for line, expression, 
and hardware breakpoints in Workbench. 


C. Pin Terminations - provides a detailed reference of pinouts for Wind 
River-supported processor families. 


On-Chip Debugging 


Almost all embedded systems have hardware and software elements, which are 
separate but interdependent. Since embedded systems generally do not have 
keyboards, or any kind of user interface, debugging of their software elements 
must be done externally. 


An older solution to this problem was the in-circuit emulator, which substituted its 
own internal processor for the central processing unit (CPU) of the embedded 
system. 


However, in-circuit emulators are expensive; and since they are made by 
third-party vendors, there is often a long delay between a new target and a new 
in-circuit emulator that can attach to it. A cheaper, and more easily implemented, 
solution is on-chip debugging (OCD). 


Many semiconductor manufacturers now integrate dedicated debug 
microcircuitry into their chips. This approach adds hardware and software debug 
capability to the existing JTAG or BDM ports. Since the debug operations occur on 
a dedicated area of the chip itself, this solution is known as on-chip debugging. 


OCD combines many features of software debug monitors and in-circuit 
emulators. Like an in-circuit emulator, OCD provides low-level hardware access. 
It does not need to use target memory; it does not need a target communication 
channel; and, for some processors, it can edit memory and registers without 
halting the processor. Like a software monitor, OCD lets you set breakpoints, stop 
and start the CPU, step through code, examine memory, and run diagnostic tests; 
but unlike a software monitor, OCD does not need good hardware to run. 


Software defects that cause the operating system to crash will typically cause an 
agent-based debug environment to fail. However, since an OCD connection is 
implemented in the hardware, it is not as sensitive. 


Table 2-1 
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An OCD connection remains active even on bad hardware. Using an OCD 
connection, you can download low-level software even when the target board is 
not functioning correctly, and the boot loader cannot run. 


On-chip debugging capability varies from one processor family to another, but the 
provided functionality is generally similar. Most processors use the following 
primitives for Background Debug Mode (BDM): 


OCD Primitives 


Command Mnemonic Description 

Read Register RDREG Read a data register and return the value. 
Write Register WDREG Write a value to a data register. 

Read Memory READ Read from a memory location. 

Write Memory WRITE Write to a memory location. 

Stop Processor BGND Assume control of the bus and put processor in 


background mode. 
Single Step STEP Step one instruction. 


Resume GO Resume execution at the program counter's 
current location. 


Wind River tools use these low-level OCD primitives as building blocks to create 
a higher level of primitives, thus allowing hardware and software verification. 


OCD commands invoked while the processor is running “steal” bus cycles from 
the CPU in the same way a Direct Memory Access (DMA) controller does. 


As the debugger reads and writes to memory and registers, it halts the CPU and 
restarts it. The CPU is not involved in OCD operations. The BGND instruction from 
the OCD hardware causes the CPU to halt, and the OCD hardware assumes control 
of chip operations. A GO (Resume) command flushes OCD operations and restarts 
the CPU. 


The Wind River Probe and Wind River ICE SX tools use the on-chip debug 
capabilities embedded in the target processor. These tools are not true in-circuit 
emulators, because they do not replace the target CPU with their own internal 
processor. However, the functions they perform are similar, and this document will 
refer to them as “emulators”. 


2 On-Chip Debugging 


OCD has many advantages over in-circuit emulation. It is cheaper; the debug 
hardware is included by the silicon manufacturer, not by a third party; and unlike 
an in-circuit emulator, the OCD hardware does not lag behind chip releases. 


When you access the OCD services on the chip, all interaction between the 
Wind River Probe or Wind River ICE SX and the target runs exclusively through 
the OCD connection. This means that your system is effective for the entire 
development process, even before board-level peripherals are stable. 


ColdFire processors, and some older PowerPC processors (5xx and 8xx) use a 
dedicated BDM port for OCD operations. A more recent approach is to attach the 
OCD functions to the Joint Test Action Group (JTAG) interface to communicate to 
the target CPU, and share this interface with boundary-scan board-circuit testing. 
The JTAG interface follows the IEEE 1149.1 boundary-scan (JTAG/Test Interface) 
specification. 


The JTAG interface consists of a set of five signals, three JTAG registers, and a test 
access port (TAP) controller. The TAP controller is typically embedded in the target 
microprocessor or device. The information related signals are TDI (Test Data In) 
and TDO (Test Data Out). The boundary-scan register chain (data) includes 
registers controlling the direction of the input/output drivers, as well as registers 
reflecting the signal value received or driven. The expectation and details of 
particular CPU chains are encoded directly into the emulator firmware. 


Each device sharing the JTAG interface employs a serial stream of relative data. 
The data streams for all devices can be chained together. An associated process can 
scan the combined chain to extract any particular device’s information. 


For further information about JTAG operations, refer to the IEEE 1149.1 
specification at http://standards.ieee.org. 


Wind River emulators are non-intrusive; that is, they do not use target resources. 
An emulator will not affect target memory, stack space, or the flash workspace. 


On-chip debug agents reside inside cache and memory management units they 
share the chip with, so the OCD hardware sees address and data values just like 
the CPU sees them. Some processor families have dedicated output signals (other 
than the JTAG pins) that can deliver information on the state of the processor. 
Combined with external hardware (such as the Wind River ICE SX, in conjunction 
with the Wind River Trace tool) these signals can log the real-time code execution 
history to a trace buffer. This data is helpful when you need to debug problems that 
only occur when the processor is running at full speed. 


There is an industry standard, not yet widely adopted, created by the Global 
Embedded Processor Debug Interface Forum, formally called IEEE-ISTO 5001. For 
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the standard, and a good deal of further information, see 
http://www.nexus5001.org/standard.html. 


Board Bring-Up 


3.1 Goals and Objectives 7 


3.2 Sequence of Events 7 


3.1 Goals and Objectives 


This chapter provides a general overview of board bring-up procedure. 


The goal of a board bring-up procedure is to verify the operation of a target board, 
all the way from power-on to successfully running and debugging code. 


3.2 Sequence of Events 


In general, the procedure of bringing up a board uses the following outline: 


» Attempt a “smoke test”- that is, see if you can apply power to the board 
without damaging it. 


« Perform a “lamp check” - turn the LEDs on and off 


= Establish a JTAG or BDM connection to the emulator. 
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« Configure the emulator-target interface: set voltage, clock rate, signal logic. 
« Enter background mode. 

« Read and write core registers. 

« Configure the target workspace. 

«Run simple RAM tests. 

« Run bus tests on the address and data buses. 

« Test low-level stepping and breakpoints. 

« Execute low-level code. 

« — Test source-level stepping and breakpoints. 

« Execute application. 

« Debug application code in RAM. 

« Test the target’s ability to erase and program flash memory. 


« Debug application code in ROM. 


OCD Connections 


4.1 Debug Connections 9 
4.2 Creating a Target Connection 10 


4.1 Debug Connections 


To create a target connection, create projects, and download code, you need a 
Wind River Probe or a Wind River ICE SX. 


For software-only tests, you can create a simulated connection using the Wind 
River Instruction Set Simulator (ISS), which is available to all users of Wind River 
Workbench OCD Edition. For instructions on using the Instruction Set Simulator, 
see the Wind River Workbench On-Chip Debugging Guide. 


The instructions in this document use a Wind River Probe connecting to a 
PowerPC750FX target. The process for connecting with the ICE is similar; for 
instructions on connecting with a Wind River ICE SX, see the Wind River ICE SX for 
Wind River Workbench Hardware Reference. 
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4.2 Creating a Target Connection 


To establish a connection with the Wind River Probe, use the following steps. 
1. Launch Wind River Workbench according to the method for your host. 
Linux/Solaris Hosts 

From your installation directory, issue the following command: 


S$ ./startWorkbench.sh 


Windows Hosts 


Select Start > Programs > Wind River > Wind River Workbench 2.6.1 > Wind 
River Workbench 2.6. 


Wind River Workbench launches. 
2. Specify a workspace. 


For Windows hosts, Workbench displays a dialog where you can specify a 
location for your workspace. For Linux hosts, the workspace defaults to 
installDirlworkspace. 


After you specify your workspace, Workbench opens and the Quick Target 
Launch dialog appears. 


Wind River On Chip Debugging 
@ Choose How You Want to Start 


Defined Launches 


Create a new launch configuration 
pe | 


Edit an existing launch configuration 


Connect, Attach, Reset and Download 


Sync with target and download symbols 


Do not show this dialog on startup 
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4 OCD Connections 
4.2 Creating a Target Connection 


The Quick Target Launch dialog allows you to create a launch configuration 
to initialize your target and download symbols and code. Once created, the 
launch configuration is persistent, so you can return to it at any time. 


If this is the first time you have launched Workbench, the only available option 
is Create a new launch configuration. The next time you open Workbench, the 
Quick Target Launch dialog will give you the option of re-launching the same 
launch configuration or creating a new one. 


3. Select Create a new launch configuration. 


The New Connection Wizard appears. 


‘W) New Connection 


Connection Type 


Please select connection type. 


Wind River Generic GDB Remote Serial Protocol Connection 
Wind River Linux KGDB Connection 

Wind River Linux User Mode Target Server Connection 
Wind River OCD ICE Connection 

Wind River OCD 155 Connection 
Wind River OCD Probe Connection 


Cancel 


4. Select Wind River OCD Probe Connection and click Next. 


The Processor Selection dialog appears. 
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% New Connection 


Wind River Probe Settings 
Configure the designator settings for the emulator. 


Designators 


©) Processor: [ PPC7SOFX | [select...] 


O Board file: 


Designator Processor Processor Plugin 
PPC?SOF% PPC750FX PowerPC 7xx Family Processor Pl... 


Communications 


USB Device Name: | PRO40310 


5. Click Select. From the list that appears, expand MPC7xx and select MPC750EFX. 
6. Click OK. 

You are returned to the Processor Selection dialog. 
7. Click Next. 


The connection wizard passes through several additional screens. For the 
purposes of this chapter you do not need to use these screens. Click Next until 
you come to the Connection Summary. 
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4 OCD Connections 
4.2 Creating a Target Connection 


New Connection 


Connection Summary 
Please review the connection information 


Connection name: | WRProbe_PPC?S0F%_0 


Summary 


Property Value 
ADDR PRO40310 
 DESIGNATORMAP 
DEVICE Wind River Probe 
NAME_MAPPING [*;*.unstripped],[*;*] 
PATH_MAPPING Gd 
STYLE USBDEVICE 


Immediately connect to target if possible 


=| a 


8. Make sure that the Immediately connect to target if possible checkbox is 


selected and click Finish. 


Workbench creates a target connection called WRProbe_PPC750EX in the Target 


Manager view. 


9. Inthe Target Manager view, click on the “+” sign next to the 
WRProbe_PPC750FX target connection name to expand it. 


Before Workbench can actually talk to the processor on the target system, 


Workbench must attach to the core. 


10. Right-click on PPC750FX [connected - stopped] and select Attach to Core. 


Workbench is now attached to the core, and able to talk to the processor. 


Workbench switches to displaying the Device Debug perspective. 


11. In the Workbench toolbar, select Window > Show View > OCD Command 


Shell. 
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The OCD Command Shell opens. 


Tasks Problems | Properties Build Console | Error Log Terminal O Trace 
Connected to PPC7S0FX) 


The prompt in the OCD Command Shell will read either >BKM> (background 
mode) or >ERR> (error.) 


There are several reasons an >ERR> prompt might appear; these will be addressed 
further on. 


The next step is to configure the emulator by setting certain configuration options, 
as described in 5. Tool Configuration. 
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Tool Configuration 


5.1 Introduction 15 


5.2 Tool Configuration 16 


5.1 Introduction 


Wind River emulators can be configured in several different ways to specify 
various settings such as electrical properties, connection logic, and clock rate. To 
configure these settings Workbench uses configuration options, or CF options, which 
you can set in the OCD Command Shell. 


This document only describes the most important CF options, ones that are 
common to all Wind River-supported processor families. For a full description of 
all Wind River CF options sorted by processor family, see the Wind River Workbench 
for On-Chip Debugging Configuration Options Reference. 


Wind River Workbench for On-Chip Debugging 
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5.2 Tool Configuration 


At the prompt in the OCD Command Shell (either >BKM> or >ERR>) enter the 
command CF with no arguments. 


This displays a list of all CF options available for your target processor, along with 
their current settings. 


>ERR>cf 

Set BreakPoint SB[SB,IHBC] = SB 

Vector Table Location VECTOR [HIGH, LOW, IGNORE] = LOW 

Monitor Target reset RST[YES,NO,HALT,RUN] = YES 

Target CPU TAR[AUTO, 603E, EC603E, 603P,603R,740,745, 

750,750CX, 750CXE, 750FX, 750GX,755,7400,7410] = 750FX 

Target CPU( SLAVE ) SLAVE [NONE, 8260] = NONE 

Slave IMMR reset value SLIMMRVAL [AUTO, VALUE] = AUTO 

JTAG clock rate (MHz) CLK[0.025...100,AUTO] = 16 
Application IMMR Exclusion Range AIMMRER[OFF,START and END] = OFF 
Application IMMR Value AIMMRVAL[VALUE] = 0e000000 

Real time Preservation RTP[YES,NO] = NO 

Little Endian Mode LENDIAN[YES,NO] = NO 

Processor Mode MODE[32,64] = 64 

Download Mode DLD[NORMAL,8] = NORMAL 

Emulator HRESET Control HRESET [ ENABLE, DISABLE] = ENABLE 
Data Parity Checking PAR[YES,NO] = NO 

Set Work Space WSPACE[BASE and SIZE] = 00000000 77c 
Set Stack Range STACK[OFF / LOWER and UPPER] = OFF 
Target Console Redirection TGTCONS [BDM,COM1,COM2] = BDM 

Drive TReset line TRESET[OPENC,ACTIVE] = ACTIVE 
Invalidate Instruction Cache on GO INVCI[YES,NO] = YES 

Reset Pulse Length N*1ms RPL[1..600] = 1 

Sense Power via HRESET SPOWER[YES,NO] = YES 

Power On Reset Length N*1ms PONR[O0..500] = 0 

CPU Reset Type RESET [HRESET, SRESET, HRESET_UNFILTER, 

SRESET_UNFI J ESET 

Trap exception TRPEXP[YES,NO POINTONLY] = YES 
Issue an IN on coldstart INCOLD [YES , NO] E 

Display L2 Data Cache Warning L2WARNING[YES,NO] = NO 

Memory Management Unit Mode MMU [ENABLE,DISABLE] = DISABLE 

Load Boot Table On IN BL[ENABLE, DISABLE] = DISABLE 
Trigger In Report Mode BRKREP[REPONLY,BRKREP] = BRKREP 
TMD Mode TMD [ENABLE, DISABLE] = DISABLE 

Run Counter Length RCL[1000..FFFF] = 1000 

Delay after Reset Nms DRST[0..10000] = 25 


5.2.1 Clock Rate 


The CLK option controls the rate at which the JTAG clock (or BDM clock) clocks 
debug commands to the target. 
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Available clock rates, and default settings, vary between processor families. Enter 
CF at the prompt and look for CLK in the list of CF options to see the available clock 
rates for your target. 


For a PowerPC 750FX target, the available rates (shown above) range from 0.025 to 
100. The default is 16. To change the clock rate, say from 16 to 32, use the following 
command: 


5 
>ERR>cf£ clk 32 | 5 


5.2.2 Drive TRESET Line 


The TRESET option controls the logic applied to the target reset (TRESET) signal 
on the target. 


The option can be set to OPENC or ACTIVE. It is set to ACTIVE by default. 


When set to ACTIVE, the emulator uses transistor-transistor logic (TTL.) The 
emulator drives the TRESET signal to both active and inactive states. On some 
targets, the conditioning resistors cause excessive rise or fall time on the signal 
when returning to an inactive state. This excessive time can cause the processor to 
come out of reset in an incorrect state. 


When set to OPENC, the emulator uses open-collector logic. The active driver is 
released by tri-stating the line and allowing conditioning resistors on the target to 
return the signal to the non-active state. 


If you are driving the TRESET signal with an external line, you should set the 
emulator to use open-collector logic. Otherwise you could have an external line 
driving the TRESET signal LOW while the emulator is driving it HIGH, thus 
causing bus contention and possible damage to the target or the emulator. 


To set the TRESET option to OPENC, use the following command: 
>ERR>cf£ treset openc 
To change it back, use the following command: 


>ERR>c£ treset active 
5.2.3 Monitor Target Reset 


The emulator continuously monitors the TRESET signal. If a target reset occurs, the 
emulator takes one of the following actions: 
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« YES - If a target reset occurs it is reported to the user, and the target is forced 
out of background mode. 


" NO-Ifa target reset occurs it is ignored. This is normally used if the code 
contains a reset instruction, which causes a reset to the external hardware, but 
does not reset the core. 


« HALT - Ifa reset occurs, the target is trapped at the restart vector. 
« RUN-Ifareset occurs, the target is restarted and remains in background mode. 


By default, this option is set to YES. When set to YES, the target will start running 
code after each reset. If you are doing low-level work -- for example, if you are 
examining register settings -- you may want the target to halt after a reset so you 
can get a target snapshot. To set this option to halt the target on a reset, use the 
following command: 


>ERR>cf£ rst halt 
To change it back, use the following command: 


>ERR>cf£ rst yes 


5.2.4 Emulator HRESET Control 


By default, the emulator asserts the hardware reset (HRESET) signal when 
initializing the hardware. 


To configure the emulator not to assert the HRESET signal when it initializes the 
board, use the following command: 


>ERR>cf£ hreset disable 
To change it back, use the following command: 


>ERR>cf hreset enable 


5.2.5 CPU Reset Type 


As stated above, the emulator asserts the hardware reset (HRESET) signal when 
initializing the hardware. You can configure the emulator to assert the software 
reset (SRESET) signal on an initialization instead. 


To configure the emulator to assert the SRESET signal instead of the HRESET 
signal when it initializes the board, use the following command: 


>ERR>cf£ reset sreset 
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To change it back, use the following command: 
>ERR>cf£ reset hreset 


You can also set this option to HRESET_UNFILTER or SRESET_UNFILTER. With the 
_UNFILTER argument added, The emulator will not sample the reset signal when 
it initializes the board. 


5.2.6 Saving Changes 


Most changes to configuration options do not take effect until you initialize the 
board, as described in 6. Board Initialization. 
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6.1 Introduction 


In order to establish communications with your target, you must first initialize it. 
Also, if the code you are running on your target causes the connection to be lost, 
you must initialize the target to restore that connection. Initialization is also 
required if you change the register settings in the emulator and want them to be 
reflected in the target. 


The target is initialized whenever you first establish a connection using your 
emulator. If you need to initialize the target when you are debugging, you can do 
it using the IN or INN initialization commands, as described in this chapter. 
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6.2 Background Mode 


In order for the emulator to work with the target, it must stop the target CPU and 
put the target in background mode. When the target is in background mode, a 
>BKM> prompt appears in the OCD Command Shell. 


If an >ERR> prompt appears in the OCD Command Shell, the target is not in 
background mode. 


6.2.1 The INCommand 


The IN command does two different things. First, it places the target board into 
background mode. Second, it copies all of the register information that is stored in 
the emulator’s NVRAM down to the target. 


To initialize the board and enter background mode, enter the following command: 
>ERR> in 


The IN command may fail for several reasons. For example, if you have not 
connected power to the target board, the output will resemble the following: 


>ERR>in 

KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KK KEK KKK KKK KKEKKKKK KKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KOR KKK KR KKK KK KR KKK KK KK KKK KK KK KKK KK KKK KK KKK KK KK KKK KKK KK KKK KKK KKK KKK KK KK KKK KKK KKK 


Support Expires....... 4/20/06 

Target Processor...... PPC750FX:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Failed 
Testing Communications to Hardware Interface....Passed 
Deiving HRESET to be High. c.«.6c4 e264 sae eee ae Passed 
Deriving HRESET to be: LOW..c.sesaesee sees edvww see Passed 
Waiting HRESET Low Acknowledge..............2.5.- Failed 
>ERR> 


For a list of the tests the emulator runs during an IN sequence, see 6.2.2 Set Verbose 
On, p.22. 


6.2.2 Set Verbose On 


To see the tests the emulator is running while attempting to enter background 
mode, put the emulator in verbose mode using the following command: 
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>ERR>set verbose on 


Then enter the IN command again. 


Here is a brief description of the tests with some possible reasons why each test 
might fail. 


Testing Communications to Hardware Interface 


This tests the hardware connectivity, and examines the communications path 
between the host and the emulator. If the test fails, ensure that you have the power 
properly connected and turned on, that the emulator is correctly connected to the 
host computer, and that your emulator hardware is properly connected to the 
target. 


Driving HRESET to be High 


This function tests the RESET signal to verify that it is HIGH. The emulator is not 
driving the RESET signal during this test, so the target must drive the RESET signal 
via a pull-up resistor. If this test fails, check to see if the target board has a pull-up 
resistor on the RESET signal to the HRESET pin of the connector. Also, check the 
target board reset logic and verify that it is not continually driving RESET LOW. 


Driving HRESET to be Low 


The RESET signal is a bi-directional signal for your unit. The emulator drives the 
RESET signal LOW and clocks it back in to verify that it is LOW. If this test fails, 
you may have contention on your RESET signal. Check to see if a device on your 
target board is continually driving RESET HIGH. Verify that the device on your 
target board that is driving the RESET signal is an open-collector device with a 
pull-up resistor. 


Attempting JTAG Communication 


During this test, the emulator stops the processor and attempts to establish JTAG 
communications. If this fails, check to see that your hardware is connected 
properly, and that the tests preceding this one passed. It is also possible that there 
is contention on your board. 


Waiting for HRESET to be Released 


The emulator only drives RESET low for a specified period of time. After RESET is 
driven LOW for the allotted time, it tri-states the RESET driver and clocks the 

RESET signal back in to see if the RESET signal went high. It continues to check for 
RESET to go high until is sees it go high or until you type Ctrl+X. If this test fails, 
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check to see if your target board reset logic is still driving the RESET signal LOW. 
Also check that your target board has a pull-up resistor to drive RESET HIGH. 


Testing for Target STOP State 


This test verifies that the processor stopped during the preceding JTAG 
Communications test by polling the processor status. If the target is still running, 
this test fails. 


Comparing Target CPU With CF Setting 


This test verifies that the emulator is properly configured for the appropriate target 
processor by comparing the processor type on your target with the processor type 
specified in your board file. If the test fails, use the CF TAR command to properly 
configure your target. For example, if you are using a PPC750FX target, and this 
test fails, enter the following commands: 


>ERR>cf tar 750fx 
>ERR>in 


Attempting to Locate IMMR register 


This test only completes for PowerPC 82xx targets. It attempts to verify the location 
of the IMMR register, which serves as a pointer to all of the other registers. If it fails, 
none of the internal registers are accessible. If the test fails, check the reset 
configuration word, located in Flash, and ensure that it is set to the correct value. 
To find the correct value for the reset configuration word for your target, see your 
target’s target.ref file, located in installDir/vxworks-6.x/target/config/your Target. 


Loading Internal Registers 


Once background communications are established, the emulator downloads 
register values from the debugger NV-RAM to the target. It will only download 
register values for those register groups that are enabled. If this test fails, see the 
information in 6.3 The INN Command, p.25. 


Testing JTAG Communication 


This test examines the JTAG communication between the emulator and the target 
using the internal clock rate for which the emulator is configured. If this test fails, 
set the internal clock to a lower rate using the following command: 


>ERR>c£ clk value 
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Attempting to restore CPU context 


This test restores the processor scan chains. 


6.3 The INN Command 


In order to get a processor into background mode, the emulator asserts the RESET 
line of the processor and then releases it. The processor and its peripherals on the 
target board are forced into their reset state, and all of the internal registers are 
forced to their manufacturer’s reset value. 


The INN command places the target in background mode without overwriting the 
target’s registers, leaving them in their default reset state for the processor. 


If the IN command fails to put the target in background mode, enter the following 
command: 


>ERR>inn 

KKK KKK KKK KEK KK KKK KKK KKK KEK KKK KKK KKK KEK KEK KEK KK KK KEK KEK KK KK KKK KKK KEK KEKE KKK KKK KKKKEKKAKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KR KKK KKK KR KK KR KKK KK KK KKK KK KK KKK KKK KK KK KKK KK KK KKK KKK KK KKK KKK KKK KR KKK KKK KKK KKK KKK 


Support Expires....... 4/20/06 
Target Processor...... PPC750FX:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Successful 
>BKM> 
Generally, if an IN command fails but an INN succeeds, it is usually caused by 


incorrect register values in the emulator's NVRAM. 


To configure register values, see 6.4 Registers, p.25. 


6.4 Registers 


Your emulator includes an area of non-volatile memory (NVRAM) where you may 
store register settings for a target. 
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Once the register values are present in NVRAM, they are automatically loaded to 
the target after each cold start, warm start, or IN initialization command. You can 
select which register values are written to the target by enabling and disabling the 
appropriate register groups. 


Wind River uses low-level SCGA commands to configure registers. Since 
configuring registers manually would require entering a large number of SCGA 
commands, Wind River provides register files for many targets. A register file is a 
Workbench-specific script that you can execute in the OCD Command Shell. 


Register files are ASCII files using the extension .reg. For example, the register file 
for the Wind River PPC750FX target is ppmc750fx.reg, located in 
installDir'workbench-2.x/dfw/build/host/registers/PowerPC/7xx/WindRiver_PP 
MC. 


6.4.1 Downloading a Register File 


To download a register file to the emulator, use the following steps: 
1. Inthe OCD Command Shell, click the Settings button. 
The OCD Command Shell Settings dialog appears, as shown in Figure 6-1. 


Figure 6-1 OCD Command Shell Settings 


%) OCD Command Shell Settings 


OCD Command Shell Settings 


PPC?SOFX 


PlayBack File Etiredi 1PowerPCh?x Rive! Cippmc?S0Fx. reales [¥] Display Background Communications 


Input Log File [ v [Append 
FullLog File | v) Tappend 


Next to the PlayBack File field, click Browse. 

Navigate to the register file you wish to use and click Open. 
Click OK. 

In the OCD Command Shell, click the Playback File button. 


Ol ee ge. i 
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The register file you selected is downloaded to your target. The commands 
from the file appear in the OCD Command Shell. 


This procedure only sets the register values in the emulator’s NVRAM, not on the 
target. To copy the register values from the emulator to the target, you must 
initialize the target with the IN command: 


>BKM>in 


Only enabled register groups are copied to the target. 


6.4.2 Enabling and Disabling Register Groups 


If you look at the ppmc750fx.reg register file, you will see that it ends with several 
lines that begin CF GRP ENABLED. Registers are stored in logical register groups. 
When you issue an IN command, the emulator only copies down register settings 
for register groups that are enabled. Register groups that are disabled on your 
target do not have register data transferred. 


Disabling a register group enables you to view the target register value, but 
prevents it from being overwritten during target initialization. 


NOTE: If you change a register value directly on the target of a register group that 
is disabled, that register does not get overwritten by the emulator during an 
initialization. Note, however, that the processor may still reset that register value 
to the processor default during a target initialization. 


To enable or disable a register group on your target, use the following steps: 
1. At the >BKM> prompt, type the command CF GRP. 

The first register group appears, as shown below: 

>BKM>c£ grp 


Group (CF GRP (M/S) Name = ENABLED/DISABLED 
CUSTOM (0=Disable 1=Enable) Enabled > 


The name of the register group is displayed, along with its current status 
(either ENABLED or DISABLED). 


2. Type 1 to enable the group or 0 to disable it. 


3. To leave the setting as it is and advance to the next register group, press the 
ENTER key without typing 0 or 1. 


4. Continue through the list of register groups enabling and disabling them as 
required. 
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5. When the register groups are enabled or disabled, type CF UPLOAD GROUP at 
the >BKM> prompt. 


This displays a list of all of the register groups on your target with their current 
settings as shown below: 


>BKM>cf£ upload group 


CF GRP GT64260_CPU ENABLED ; GROUP 
CF GRP GT64260_SDRAM ENABLED ; GROUP 
CF GRP GT64260_DEVICE ENABLED ; GROUP 
CF GRP GT64260_GPP ENABLED ; GROUP 
CF GRP GT64260_MPP ENABLED ; GROUP 
>BKM> 


6.4.3 Modifying Registers Manually 


Wind River supplies register files for Wind River evaluation boards, as well as for 
many third-party target boards. 


If you are using a target for which Wind River does not supply a register file, you 
may have to create one. For instructions on creating register files, see the Wind 
River Workbench for On-Chip Debugging User Tutorials: Configuring Target Registers. 


Remember that the register file sets the register values in the emulator NVRAM, 
not on the target. The emulator copies the values you set in its NVRAM down to 
the target when you initialize the target with an IN command. Without a register 
file, the NVRAM contains default register values, typically made for a Wind River 
evaluation board, which most likely are not suitable for your target. So the IN 
command will not set the target registers properly. 


Some target processors, for instance most PowerPC targets, come with default 
register settings. If your target has default register settings, you can modify the 
registers directly on your target manually, at least to the point where you can 
download your boot ROM application code. 


Remember that if you modify your registers manually, any initialization command 
or target reset will overwrite your changes. 


To modify registers manually, use the Registers view in Workbench. The Registers 
view lets you examine the bit-level detail for each register. The following sections 
describe the Registers view and the bit-level detail provided. 


The Registers View 


When the Registers view is open in Workbench, all of the register groups for your 
target are displayed with + signs beside them. Clicking on a + sign expands the 
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register group, showing all of the registers that are included in that register group 
along with the value that they are currently set to. An example of an expanded 
register group is shown in Figure 6-2. 


Expanded Register Group 


Local Yariables Memory 3B Registers x 


Ra Ce Ca Y 


Name Enabled Value En 
+ GPR 
+ CTRL 
+ MMU 
+ FPU 
= 
=] ictc oxo0000000 
FI ox00 
E Ox0 
pmel 0x00000000 
pmc2 ox00000000 
pmc3 oxo0000000 
pmct+ ox00000000 
+ mmerO ox00000000 
+ mmert O0x00000000 
sia oxooo00000 
+ L2CACHE 
+ THERMAL 


< 


NOTE: Figure 6-2 is only an example of an expanded register group. The groups 
and the register values vary widely depending on your target architecture. 


Bit-Level Detail 


You can view the bit-level detail for any register by clicking on the + sign beside 
the register in the register group. 


NOTE: Before you can make any changes to your register settings, you need to 
enable the register group that contains the register you want to modify, so that the 
values download to the target when you initialize your system. If you do not 
enable the register group, you can still modify the settings in the emulator but not 
on the target. For more information, see 6.4.2 Enabling and Disabling Register 
Groups, p.27. 
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You can make changes to any of the register settings by modifying each of the 
bit-level settings for any register. 


To modify bit-level values for your target, complete the following steps: 
1. Inthe Registers view, double-click on the name of the register you wish to edit. 


This opens the Properties view, which shows the name of the register you have 
selected under the Property heading and its current setting under the Value 
heading, as shown in Figure 6-3. 


Properties View 


Disable instruction cache throttling 
obo 

0 

oo 


2. Select the value under the Value heading and edit it as necessary. 


3. Inthe Registers view, click Refresh Values. The register information 
reappears with your changes. 


NOTE: Some registers are write-protected and cannot be edited. 


For more information on registers, including creating custom registers and register 
groups, see the Wind River Workbench for On-Chip Debugging User Tutorials: 
Configuring Target Registers. 


When you have initialized your target and entered background mode, with a 
>BKM> prompt showing in the OCD Command Shell, you can proceed to test your 
hardware, as described in 7. Verifying Hardware. 
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7.1 Introduction 


This chapter describes several tests and diagnostics you can use to verify that your 
hardware is working correctly. 


7.2 Setting a Workspace 


NOTE: The RAM workspace has no relation to the workspace that Workbench uses 
to store project information. 


The workspace is an area of RAM on the target that the emulator uses to download 
the hardware diagnostic routines and flash programming algorithms. 
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You must tell your emulator where writable RAM is located on your target for this 
purpose. 


Depending on the device family and type, this space is limited to under 2 KB. Note 
that more memory improves the speed of programming. 


To configure the workspace, enter the parameters using the syntax 
CF WSPACE base size 


where base is the start address, and size is the minimum number of bytes of target 
RAM required. 


To find the base and size values for a Wind River-supported target, consult your 
target’s target.ref file, located in installDir/vxworks-6.x/target/config/yourTarget. 
Alternatively, consult your processor documentation. 


For a Wind River PPC750FX target, the base of the workspace is 00000000 and the 
size is 6000. To set the workspace, enter the command 


>BKM>c£ wspace 0 60000 


This sets the workspace at address 0 with a size of 0x00006000 bytes. 


7.3 Diagnostic Functions 


Wind River Workbench provides a set of RAM and bus diagnostics and utilities 
that can be controlled by the emulator or run on the target. 


Some of the following tests can run code directly on the target instead of through 
the emulator by selecting the Run on Target checkbox. This allows the test to run 
at the execution speed of the target processor. 


7.3.1 Simple RAM Test 


This test writes and reads back a simple pattern to the memory bounded by the 
starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address are displayed 
in the Output field. 
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The first diagnostic to be run is a Simple Ram Test on the area of memory used by 
the workspace. 


J, 


on 


4 
a: 
6 
7 


In the Workbench toolbar, select Window > Show View > Hardware 


Diagnostics. 


In the Diagnostic field, select Simple RAM Test — Single Pass. 


The workspace cannot be used to test itself, so make sure the Run on target 


checkbox is unchecked. 


In the Start Address field, enter 0. 
In the End Address field, enter 6000. 
In the Units field, select LONG. 


Click Run. 


Workbench displays the test result in the Output field. The output of a successful 


test will resemble that in Figure 7-1. 


Successful Simple RAM Test 


Tasks Problems Properties Build Console Error Log OCD Command Shell © Hardware Diagnostics % 


Choose Diagnostic 
Diagnostic 


Simple RAM test - Single pass 


Description 


he Single RAM Test Single Pass writes and reads back a 
imple pattern to the memory bounded by the starting 
ind ending addresses entered in the fields below, IF an 
rror occurs, the test stops and the error type and 
ddress will be displayed. 


Start address: | oxoo000000 
End address: [ ox00006000 


Units LONG 


{JRun on target 


imple ram test running 
est complete 


If the test fails, the Address Bus Test diagnostic and the Data Bus Test diagnostic 
may determine the cause of the failure; see 7.3.5 Bus Tests, p.36. 


If the RAM test of the memory used by the workspace passed, the rest of the 
memory in the target system can now be tested at full bus speed. 
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In the Diagnostic field, select Simple RAM Test — Single Pass. 
Select the Run on Target checkbox. 

In the Start Address field, enter 14000. 

In the End Address field, enter 20000000. 

In the Units field, select LONG. 

Click Run. 

Workbench displays the test result in the Output field. 


Oe Gr Roo he 


If the message Test Complete appears, then the diagnostic passed. 


If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 7.3.5 Bus Tests, p.36. 


7.3.2 Full RAM Tests 


A Full RAM test writes a “walking” 1 on each bit of RAM and reads it back. This 
is a very lengthy test and can detect bus configuration errors, typically on a new 
printed circuit board. 


This test sets and then clears each bit to try to locate memory defects bounded by 
the starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address will be 
displayed in the Output field. 


NOTE: A complete Full RAM test would take several years to finish, so make sure 
you specify a very small region of memory to be tested. 


Full RAM tests are designed to check for cell disturbance and addressing 
problems. These tests perform the following actions: 


A Single Pass test will run the test only once. A Continuous test will repeat the test 
over the same address until you click Stop. 


1. Inthe Diagnostic field, select Simple RAM Test - Single Pass. 
2. Select the Run on Target checkbox. 

3. Inthe Start Address field, enter 14000. 

4. Inthe End Address field, enter 14100. 
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5. Inthe Units field, select LONG. 

6. Click Run. 

Workbench displays the test result in the Output field. 

If the message Test Complete appears, then the diagnostics passed. 


If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 7.3.5 Bus Tests, p.36. 


7.3.3 CRC Calculation 


Workbench and the emulator support the calculation of a Cyclic Redundancy 
Check (CRC) on all addresses in the range specified. The CRC test will checksum 
a block of data on the target for the address range you specify in the CRC 
Calculation dialog. The CRC algorithm is based on the following polynomial: 


x16 + x415 + x42+1 
Workbench uses this polynomial as follows: 


Workbench reads a location and uses the value read, x, to calculate the CRC. Then 
Workbench adds the result to the value calculated for the previous address. This 
process continues until Workbench has checked the entire specified memory 
range. 


The CRC sum will be returned if the communications with the emulator and target 
are working. To interrupt the test, click Stop. 


7.3.4 Scope Tests 


Read From Location 


The Read From Location Scope Test performs a memory read of designated length 
from the address entered in the From Address field. 


Write To Location 


The Write To Location Scope Test performs a memory write of designated length 
of the value entered in the Data Value field to the address in the To Address field. 
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Write and Complement 


The Write and Complement Scope Test performs a memory write of designated 
length of the value entered in the Data Value field to the address in the To Address 
field; the value is then complemented. 


Write Rotating Value 


Write Then Read 


The Write Rotating Value Scope Test performs a memory write of the value entered 
in the Data Value field to the address in the To Address field. The value is then 
rotated through all of the bit positions with respect to the designated length of the 
memory address. 


The Write and Read Scope Test performs a memory write of designated length of 
the value entered in the Data Value field to the address in the To Address field; the 
value is then read back. 


7.3.5 Bus Tests 


Address Bus Test 


Data Bus Test 


This test detects faults in the address bus over the range bounded by the starting 
and ending addresses entered in the Start Address and End Address fields. This 
test can be interrupted by clicking the Stop button. 


This test detects faults in the data bus over the range bounded by the starting and 
ending addresses entered in the Start Address and End Address fields. This test 
can be interrupted by clicking the Stop button. 


When you have tested your hardware successfully, you must test your ability to 
read and write memory, as described in 8. Testing Memory. 
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8.1 Introduction 


Before handling more complex application code, the target system must be able to 
handle low-level assembly instructions. 


Wind River Workbench includes a simple diagnostic to test the target’s ability to 
write to memory, set breakpoints, and run and step code. This diagnostic writes a 
loop of NOP instructions at a specified memory address. 


8.2 Testing Memory 


To run the memory diagnostic, use the following steps. 
1. At the >BKM> prompt in the OCD Command Shell, enter DF E 14000. 
This writes a NOP loop at address 0x14000. 
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2. Enter the command DI 14000. 

This command disassembles the instructions at 0x14000. 
3. Enter the command SR PC 14000. 

This command sets the Program Counter to address 0x14000. 
The output should resemble that shown below. 


>BKM>df e 14000 


>BKM>di 14000 
$00014000 : 0x60000000 :ppc nop 
$00014004 : 0x60000000 :ppc nop 
$00014008 : 0x60000000 :ppc nop 
$0001400C : 0x60000000 :ppc nop 
$00014010 : Ox7COOO04AC :ppc sync 
$00014014 : Ox4BFFFFFO :ppc b 0x14004 
$00014018 : 0x00000000 :ppc dc.1 0x0 
$0001401C : 0x00000000 :ppe dc.1 0x0 
$00014020 : 0x00000000 :ppe dc.1 0x0 
$00014024 : 0x00000000 :ppe de.1 0x0 
$00014028 : 0x00000000 :ppe dc.1 0x0 
$0001402C : 0x00000000 :ppc dc.1 0x0 
$00014030 : 0x00000000 :ppe dce.1 0x0 
$00014034 : 0x00000000 :ppe de.1 0x0 
$00014038 : 0x00000000 :ppc dc.1 0x0 
$0001403C : 0x00000000 :ppce dc.1 0x0 
$00014040 : 0x00000000 :ppe de.1 0x0 
$00014044 : 0x00000000 :ppec de.1 0x0 
$00014048 : 0x00000000 :ppc dc.1 0x0 
$0001404C : 0x00000000 :ppc dc.1 0x0 

>BKM>sr pce 14000 

>BKM> 


Now there is a simple program in the target’s memory, and the Program Counter 
has been set to 0x14000. 


8.2.1 Stepping an Instruction 


First, test to see if the system can handle the step instruction command. 
In the Debug view, click the Step Into button. 


The Disassembly view opens, with the Program Counter now at 14004, as shown 
in Figure 8-1. 
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Figure 8-1 Disassembly View 


|C) diabasm.s | {C) cdemo.c | \C) strutils.c \C) calendar.c WRProbe_PPC7SOFX 5% 
‘System Context 
> 00014004: nop hed) 
00014008: nop 
0001400c: nop 
00014010: sync 
00014014: b Ox14004 
00014018: .- long in) 
0001401c: . long in) = 
00014020: - long in) 
00014024: - long o 
00014028: . long Oo 
0001402c: . long in) 
00014030: . long in) 
00014034: - long ia) 
00014038: - long in) 
0001403¢: - long in) 
00014040: - long Oo 
00014044: . long o 
00014048: . long in) 
0001404c: . long in) 
00014050; - long ia) 
00014054: . long in) 
00014058: . long in) 
000140S5e: - long in) 
00014060: .- long ia 
00014064: - long Oo 
00014068: . long in) 
0001406c: - long oO wi 
nantanzo. Lene 9. pe] 


Also, the System Context in the Debug view now reads 0x14004, as shown in 
Figure 8-2. 


Figure 8-2. System Context 


© Debug X 


o> “ 
i= &} WRProbe_PPC?S50Fx [Attach to Target] 
=)? PPC750FX (System Mode) 
=) a System Context (Stopped - Step End) 
oO pre 
14004 
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8.2.2 Running Code 


Next, test to see if the processor can run the simple program at full bus speed. 


In the Debug View, click the Resume button to start the target. In the Debug view, 
the System Context changes to Running, and a >RUN> prompt appears in the 
OCD Command Shell. 


Wait a few seconds and then click the Suspend button to stop the target. In the 
Debug view, the System Context changes to Stopped -- User Request, as shown 
in Figure 8-3. 

Figure 8-3 System Context 


® Debug X 


o> by 22 Rk B= 
5 &} WRProbe_PPC?S50FX [Attach to Target] 
Se ad PPC?50FX (System Mode} 
5 By System Context (Stopped - User Request) 
8 0x14010 


Also, the Disassembly view updates to show the new location of the Program 
Counter, as shown in Figure 8-4. 
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Figure 8-4 Program Counter at 14010 


(C) diabasm.s C) cdemo.c IC) strutils.c \C) calendar.c 52 WRProbe_PPC7SOFX 53 
System Context 
00014004: nop a 
00014008: nop 
0001400c: nop 
> 00014010: sync 
00014014: b 0x14004 
00014018: - long oO 4 
0001401c: . long 0 
00014020: » long O 
00014024: . long oO 
00014028: . long 0 
0001402¢c: . long in) 
00014030: . long oO 
00014034: . long oO 
00014038: » long ia) 
0001403c: . long oO 
00014040: . long oO 
00014044: » long in) 
00014048: . long oO 
0001404c: . long 0 
00014050: » long ia) 
00014054: . long oO 
00014058: . long oO 
0001405c: . long ia) 
00014060: . long oO 
00014064: . long oO v 


8.2.3 Setting Software Breakpoints 


Next, test to see if the target can set a software breakpoint. 


In the Disassembly view, double-click to the left of address 0x14008 (in the gutter.) 
Workbench places a software breakpoint at address 0x14008, as shown in 
Figure 8-5. 
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Figure 8-5 Planted Software Breakpoint 


\C) diabasm.s \C) cdemo.c C) strutils.c | |C) calendar.c === WRProbe_PPC750FX% X 
System Context 
00014004: 
Goo0014008: 
0001400c: 
® 00014010: 
00014014: 
00014018: 
0001401c: 
00014020: 
00014024: 
00014028: 
0001402c: 
00014030: 
00014034: 
00014038: 
0001403c¢: 
00014040: 
00014044: 
00014048: 
0001404¢c: 
00014050: 
00014054: 
00014058: 
0001405c: 
00014060: 
00014064: 


oo0oo Coo Oo OmOoooocooc oO oO ec Oo 6 


The breakpoint at address 0x14008 appears in the Breakpoints view. 


Figure 8-6 Breakpoints View 


“e Breakpoints * 


e % B « HES’ 
fim Ox14008 (*Planted*, Restricted Scope) 


In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
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showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 


>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014008 [EVENT Taken] 
>BKM> 


This output shows that the software breakpoint at address 0x14008 has been hit. 
In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


Figure 8-7 System Context 


® Debug * 


Oe i 29 8% B 
= # wRProbe_PPC7SOFx [Attach to Target] 
=) PPC7SOFX (System Mode) 
= a System Context (Stopped - Breakpoint Hit) 
8 0x1 4008 


To remove the software breakpoint, double-click on the breakpoint icon to the left 
of address 0x14008 in the Disassembly view. 


8.2.4 Setting Hardware Breakpoints 


Next, test to see if the system can handle setting hardware breakpoints. 


In the Disassembly view, right-click to the left of address 0x1400C (in the gutter) 
and select Add Hardware Breakpoint. Workbench places an internal hardware 
breakpoint at address 0x1400C, as shown in Figure 8-8. 


43 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for PowerPC, 2.6.1 


Figure 8-8 Planted Hardware Breakpoint 


C\ diabasm.s | |) cdemo.c (C) strutils.c IC) calendar.c 52" WRProbe_PPC7S0FX 53 
System Context 
00014004: nop “a 
00014008: nop 
f}0001400c: nop 
00014010: sync 
00014014: b 0x14004 
00014018: . long oO 
0001401c: . long 0 
00014020: . long 0 
00014024: . long 0 
00014028: . long 0 
0001402c: . long in) > 
00014030: . long in) 
00014034: . long 0 
00014038: . long in) 
0001403c: . long in] 
00014040: . long 0 
00014044: . long ia) 
00014048: . long in) 
0001404c: . long 0 
00014050: . long 0 
00014054: . long 0 
00014058: . long 0 
0001405e¢: . long 0 
00014060: . long ia) 
00014064: . long ia) v 


The hardware breakpoint at address 0x1400C appears in the Breakpoints view. 


Figure 8-9 Breakpoints View -- Hardware Breakpoint 


“= Breakpoints * 


a Ox1400c (*Planted*, Hardware,Restricted Scope) 


In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
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showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 

>RUN> 

!BREAK! - [msg11001] Internal hardware breakpoint; PC = 0x0001400c [EVENT 
Taken] 

>BKM> 


This output shows that the hardware breakpoint at address 0x1400C has been hit. 


In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


To remove the hardware breakpoint, double-click on the breakpoint icon to the left 
of address 0x1400C in the Disassembly view. 


If all these steps perform successfully, the target can run and debug low-level 
assembly code. The next step is to run and debug application code, as described in 
9. Debugging in RAM. 
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9.1 Overview 


This chapter describes the process of running and debugging application code in 
RAM using Wind River Workbench. 


9.2 Creating a Target Connection 


To download and run code and symbol information, you must have an active 
target connection. 
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To create a target connection, create projects, and download code, you can use a 
Wind River Probe, a Wind River ICE SX, or the Wind River Instruction Set 
Simulator (ISS), which is available to all users of Wind River Workbench OCD 
Edition. 


To create a target connection, use the procedure described in 4. OCD Connections. 


9.3 Creating a Project 


In order to download and run code and symbol information in RAM, you must 
have an active project open. 


Several example projects are included in Wind River Workbench for 
demonstration purposes. To open a new demonstration project, use the following 
steps: 


1. Select File > New > Example. 


The New Example wizard appears, as shown in Figure 9-1. 
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Figure 9-1 New Example Wizard 


% New Example 


Select a wizard 


Creates a new O5S-agnostic sample project 


Wizards; 


=| & Examples 
(0% Embedded Linux Sample Project 
(9 Native Sample Project 
a 
\R@ VxWorks Downloadable Kernel Module Sample Project 
{P% VxWorks Real Time Process Sample Project 
(8 Wind River Linux Sample Project 


Cancel 


2. Select Standalone Sample Project and click Next. 


A sample project template appears, as shown in Figure 9-2. 
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Figure 9-2 Sample Project Template 


% New Project Sample 


Sample Project Template 


Select a sample project template. 


Available Examples: Information: 


C Demonstration Program 

(C++ Demonstration Program This program demonstrates various C 

(S$ The Ball Demonstration Program language Features including structures, 
(The Panel Demonstration Program character arrays, linked lists, and recursion. 
You can build and download this program 
to your simulator or target board, The 
default RAM location for the program is 
0x00014000, To change the default 
memory address, edit the simple. lk linker 
command File, 


Features 


The Following Features are demonstrated 


3. Click Finish. 


Workbench creates the sample project in the default workspace directory, and 
the project name c_demo_sa appears in the Project Navigator view. 


4. Inthe Project Navigator view, expand the c_demo_sa project. 


A number of available build specs appear. 
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Figure 9-3 c_demo_sa 


@ arm-0x00000000-LE-diab_DEBUG 
@ arM-0x04000000-BE-diab_DEBUG 
@ arM-0x04000000-LE-diab_DEBUG 
 @Y ARM-0x08000000-BE-diab_DEBLIG 
@2 aRM-0x08000000-LE-diab_DEBUG 
t# @ McF-0x00000000-BE-diab_DEBUG 
@ mcF-0x20000000-BE-diab_DEBUG 
(29 mcF-0x40000000-BE-diab_DEBUG 
(29 mips32-4KEc-BE-16bit-diab_DEBUG 
(29 mips32-4KEc-BE-32bit-diab_DEBUG 
(29 mIpS32-4KEc-LE-16bit-diab_DEBUG 
(29 MIPS32-4KEc-LE-32bit-diab_DEBUG 
te (28 MIPS32-4Kx-BE-32bit-diab_DEBUG 
tH) G2 MIPS32-4Kx-LE-32bit-diab_DEBUG 
4) @22 MIPS32-BCM-BE-32bit-diab_DEBUG 
(4) G29 MIPS32-BCM-LE-32bit-diab_DEBUG 
(4) 22 MIPS32-IDT-BE-32bit-diab_DEBUG 
4-29 MIPS32-IDT-LE-32bit-diab_DEBUG 
(4-29 MIPS32-PHI-BE-32bit-diab_DEBUG 
(4-22 MIPS32-PHI-LE-32bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-16bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-32bit-diab_DEBUG 
(29 mips32-PNX-LE-16bit-diab_DEBUG 
(2? mIPS32-PNX-LE-32bit-diab_DEBUG 
(29 mips32-WISS-BE-32bit-diab_DEBUG 
(29 mips32-WISS-LE-32bit-diab_DEBUG 
(29 mipsé64-20Kc-BE-diab_DEBUG 
(29 mIps64-20Kc-LE-diab_DEBUG 
(29 mIps64-Skc-BE-diab_DEBUG 
(29 mIps64-Skc-LE-diab_DEBUG 
(29 mipsé4-RM9000_P0-BE-diab_DEBUG 
(29 mipsé4-RM9000_PO-LE-diab_DEBUG 
(29 mipsé4-RM9000_P1-BE-diab_DEBUG 
(29 mipsé4-RM9000_P1-LE-diab_DEBUG 
(29 mipsé4-RM9000-BE-diab_DEBUG 
(2 MIPS64-RM9000-LE-diab_DEBUG 
(22 mIPS64-1X49-BE-diab_DEBUG 
(29 mips64-1%49-LE-diab_DEBUG 
(29 mips64-VR4131-BE-diab_DEBUG 
(29 mips64-VR4131-LE-diab_DEBUG 


2-2-2 oe ee ee 


5. To build the sample project, right-click on the c_demo_sa top-level folder and 
select Build Options > Set Active Build Spec. 


The Set Active Build Spec and Debug Mode dialog appears, as shown in 
Figure 9-4. 
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Figure 9-4 Set Active Build Spec and Debug Mode Dialog 


W Set Active Build Spec and Debug Mode 


PPC603diab-WI5S 
MIPS32-4KEc-BE-16bit-diab 
MIPS32-4KEc-LE-16bit-diab 
MIPS32-4KEc-BE-32bit-diab 
MIPS32-4KEc-LE-32bit-diab 
MIPS32-4Kx-BE-32bit-diab 
MIPS32-4Kx-LE-32bit-diab 
MIPS32-BCM-BE-32bit-diab 
MIPS32-BCM-LE-32bit-diab 
MIPS32-IDT-BE-32bit-diab 
MIPS32-IDT-LE-32bit-diab 
MIPS32-PHI-BE-32bit-diab 
MIPS32-PHI-LE-32bit-diab 
MIPS32-PNX-BE- 1 6bit-diab 


Debug mode (use debug mode flags) 


6. Select the build spec for your target family. This document uses the Wind River 
PPC750FX for its examples, so Figure 9-4 shows the PowerPC build spec. 


7. Select Debug mode (use debug mode flags) so Workbench will generate 
symbolic debug information. 


8. Click OK. 
9. Right-click on the c_demo_sa folder and select Build Project. 


Workbench builds the sample project using the Wind River Compiler. The results 
of the project build appear in the Build Console view, as shown in Figure 9-5. 
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Figure 9-5 Build Console View 


Tasks Problems Properties BIS7=!¥) Tete) e4 Error Log Terminal 0 OCD Command Shell 4 


s&s & | be &. 
echo “ ‘building PPC603diab | DEBUG iinklist.o";dcc -g -Xdebug-dwart2 -EPPC603ES: simple -DTOOL_FAMILY=diab -DTOOL=d a 
flinklist.o" -c “linklist.c" 
building PPC603diab_DEBUG /linklist.o 
echo "building PPC603diab_DEBUG/date.o";dcc -g -Xdebug-dwarf2 -t-PPC603ES:simple -DTOOL_FAMILY=diab -DTOOL=diz 
e.0" -c "date.c" 
building PPC603diab_DEBUG/date.o 
echo “building PPC603diab_DEBUG/math.o";dec -g -Xdebug-dwarf2 --PPC603ES:simple -DTOOL_FAMILY=diab -DTOOL=di. 
h.o" -c "math.c" 
building PPC603diab_DEBUG/math.o 
echo “building PPC603diab_DEBUG/addone.o";das -tPPC603ES: simple -DTOOL_FAMILY=diab -DTOOL=diab -DPowerPC -D 
building PPC603diab_DEBUG/ addone.o 
echo "building PPC603diab_DEBUG/cdemo.elf"; did -o "PPC603diab_DEBUG/cdemo. elf" --PPC603ES:simple cdemo-POWERF 
3diab_DEBUG/strutils.o PPC603diab _ DEBUG/engineer. o PPC603diab_DEBUG/calendar.o PPC603diab_DEBUG/linklist.o PPC _ 
"4; then echo "building Run plink utility"; plink PPC603diab_DEBUG/cdemo. elf ;Fi 
building PPC603diab_DEBUG/‘cdemo.elf 
make: built targets of C:/WindRiver/workspace/c_demo_sa 
Build Finished in Project "c_demo_sa‘: 2006-05-01 11:05:57 (Elapsed Time: 00:08) 


< Mm | 


NOTE: When using projects other than the supplied demonstration projects: you 
must compile your programs using debugging symbols (the -g compiler option) to 
use most debugger features. The compiler settings used by the Wind River 
Workbench project facility’s Managed Builds include debugging symbols. 


However, Workbench does not support code compiled with -02 optimization. 


9.4 Downloading Code and Symbol Information 


To run the sample code, right-click on cdemo.elf in the Project Navigator view and 
select Reset and Download. 


The Reset and Download view appears, as shown in Figure 9-6. 
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Figure 9-6 Reset and Download 


W WRProbe_PPC750FX - PPC750FX 


Modify attributes and launch. 


Name: | WRProbe_PPC7SOFX - PPC750FX 


@ Main | @® Reset | @ Download | @ Instruction Pointer | # Run Options | %% Projects to Build | &% Source | 5) common 


Connection 
Connection to use: | WRProbe_PPC750FX (localhost) v (Hide unconnected 


ect WRProbe_PPC7S0FX - WRProbe_PPC7SOFX is connected. 


Core: | PPC7S50F% v| 


Apply Revert 


When opened from this folder, the Reset and Download view is pre-configured for 
this project. 


Leave the settings at their defaults and click Debug. 


The OCD Console view opens, as shown in Figure 9-7. 
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Figure 9-7 OCD Console 


} 5) (ES = 7 _ 7 3 T = 
Tasks | Problems | Properties Build Console Error Log TerminalO Trace OCD Command Shell OCD Console X 


Reset and Download 


Testing Communications to Hardware Interface..., Passed 
Driving HRESET to be High aay Passed 
Driving HRESET to be Low Passed 
Waiting HRESET Low Acknowledge. ‘ag Passed 
Attempting JTAG communication.... Passed 
Waiting for HReset to be released.. ; Passed 
Testing For target STOP State. Passed 
Comparing target CPU with CF setting ai. Passed 
Waiting for HRESET High Acknowledge 7 Passed 
Testing JTAG Communication nH Passed 
Loading Internal Registers.. Passed 
Testing JTAG Communication... a Passed 
Getting value of cf mmu option .. Passed 
Attempting to restore CPU contex' Passed | 
C:\WindRiver\workspace\c_demo_sa\PPC603diab_DEBUG\cdemo. elf COCO 
Loading symbols... Completed at Default Offset (<1 sec) 
Specified not to Run 

* Reset and Download Completed * 

< 


The OCD Console view shows the progress of the download operation, as 
Workbench downloads the sample code to the target. 


The Editor opens showing the Program Counter set at the beginning of the 
application code, as shown in Figure 9-8. 
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Figure 9-8 Editor 


{@ diabasm.s X C) cdemo.c Ic) strutils.c [c) calendar.c 


-ifdef PowerPC “ 


DeeeeeeeaaeeeeeeeeesKSTAAEKTETEKERKEEEEEREREEREEKEEEEEEREETEEERREEEEEERE 


-section§ .text,,C 
-globl _start, START, ENTRY 
-extern main 


ri1i,r0,__SP_INIT@ha # Initial Stack Pointer 
ri,riil,__SP_INIT@1 


r13,r0, SDA_BASE_@ha # Small Data area 
ri3,r13, SDA_BASE @1 


r2,r0, SDA2_ BASE _@ha # Small Data Area 2 
r2,r2,_SDA2_BASE @1 


rO0,r0,0 # Push O onto stack 
r0,-64(r1} 


main 


deadloop: 
b deadloop 


-globl addone 


You are now ready to run and debug the application. 


9.5 Debugging Code in RAM 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 
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Figure 9-9 Debug View 


® Debug X 
o> by 2@R®Re 


=) &} WRISS_MPC8540 [Attach to Target] 
i MPC8540 (System Mode) 
5 a System Context (Stopped) 


8 start(} - diabasm.s:44 


9.5.1 Monitoring Processes 


When you start processes under debugger control, or attach the debugger to 
running processes, they appear in the Debug view labeled with unique colors and 
numbers. You can change the color assigned to a process or thread by right-clicking 
the process or thread and selecting Color > specific color. 


9.5.2 Stepping Through Code 
The Editor shows the source file diabasm.s, showing the c_demo_sa project’s 
initialization assembly. 
In the Debug view, click the Step Into button. 


The Program Counter moves to the second assembly instruction. If you open the 
Memoty view or the Registers view, you can see them update memory and 
register values as you step through instructions. 


Click the Step Into button seven more times, to step through all the initialization 
code and reach the first branch instruction: 


bl main 
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This is where the application branches out of assembly into C code. 
Click the Step Into button again. 


The application branches into main() and the Editor opens the source file cdemo.c, 
as shown in Figure 9-10. 


Figure 9-10 C Source 


IC) diabasm.s {C) cdemo.c 58 IC) strutils.c 55) WRProbe_PPC7S0FX IC) linklist.c fi 


int initval; /* initialization value for calculation */ #@ 
char *globalstring[3]; /* Uninitializeded array of string pointers 


char bell[2] = {BELL_CHAR, '\0'}? 


Df/AeeeeAAAAAAAAKARAAAA TEAR AEEAAAALERAAA AER AA AAA AAA ATTRA ATTRA AA ATA A ATES 
Tint main() 
{ 
volatile long demo counter; 


> volatile int pfa_demo=0; 
int sum = 0; 
volatile char cvar; /* sample char variable */ 


REC_TYPE1 q; 
volatile int localiInti; 
volatile long localLong1; = 


/* Setup the global string array */ 


globalstring[0] = "zero"; 
globalstring[1] = "one"; 
globalstring[2] = "two"; 


f* Initialize the rectest structure */ 

rectest.long integer = OxFFFFEEEE; 

rectest.short_integer = 5555; 

rectest.integer_array[0] = 0; 

rectest.integer_array[1] = 10; 

rectest.integer_array[2] = 20; 

rectest.integer array[3] = 30; 

rectest.string pointer = "Wind River's Tool Product Family"; 


\< 


9.5.3 Setting a Software Breakpoint 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. For a full explanation of Workbench breakpoints, 
see B. Internal Breakpoint Capabilities. 


In the left ruler of the Editor (the gutter), double-click to the left of the source line 


globalstring[2] = “two”; 
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This sets a software breakpoint on that source line. The breakpoint appears in the 
Breakpoints view. 


Figure 9-11 Planted Software Breakpoint 


*» Breakpoints X 


In the Debug view, click the Resume button. The program runs until it hits the 
breakpoint. The System Context changes to Stopped -- Breakpoint Hit. 


Figure 9-12 System Context -- Stopped 


® Debug X 


o> by 28 eR = 
2 &} WRProbe_PPC?S0Fx [Attach to Target] 
9" PPC7SOFX (System Mode) 
=| a System Context (Stopped - Breakpoint Hit) 
| 


a maint) - cdemo.c:113 


= diabasm.s:58 


Breakpoint information also appears in the OCD Command Shell: 
>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014074 [EVENT Taken] 
>BKM> 


9.5.4 Running a Program 
To run your downloaded program, click Resume in the Debug view. The program 


will run until it hits a breakpoint. If there are no breakpoints or interrupts, the 
program will run to completion or until you click Suspend. 
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When the program is running, the System Context changes to Running, as shown 
in Figure 9-13, and a >RUN> prompt appears in the OCD Command Shell. 


Figure 9-13 System Context -- Running 


® Debug X 


00 oe 
= &} WRProbe_PPC?S50Fx [Attach to Target] 


System Context (Running) 


If there are no breakpoints, you can stop the program by clicking the Suspend 
button in the Debug view or by entering the HA command at the >RUN> prompt 
in the OCD Command Shell. 


The Editor updates to show the current location of the Program Counter and the 
System Context in the Debug view changes to Stopped -- User Request. 


Figure 9-14 System Context -- Stopped 


® Debug X 
o> oy 23.2 «= 
=) #9 wRProbe_PPC7SOFX [Attach to Target] 


)-@ PPC?SOFX (System Made) 
=) cy System Context (Stopped - User Request) 


a dayOFYear() - calendar.c:213 
= calendar() - calendar.c:122 
=" main() - cdemo.c:184 

=" diabasm.s:58 


9.5.5 Stepping Through a Program 


To single-step without going into other subroutines, click Step Over instead of 
Step Into. 


While stepping through a program, you may conclude that the problem you are 
interested in lies in the current subroutine’s caller, rather than at the stack level 
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where your process is suspended. In this situation, if you click Step Return, 
execution continues until the current subroutine completes, then the debugger 
regains control in the calling statement. 


9.5.6 Setting a Hardware Breakpoint 


The availability of hardware breakpoints varies by architecture. You can only set 
as many hardware breakpoints as there are debug registers available on your 
target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 
Breakpoint Capabilities. 


In the Breakpoints view, click on the Menu button and select Add Data 
Breakpoint. 


The Data Breakpoint dialog appears, as shown in Figure 9-15. 


If an error message appears, you may have exceeded the number of allowed 
hardware breakpoints (four for most targets). Right-click in the Breakpoints view 
and select Remove All. Then select Menu > Add Data Breakpoint again. 


If an error message still appears, your target may not support hardware 
breakpoints. 
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Figure 9-15 Data Breakpoint Dialog 


% Data Breakpoint Properties 


Breakpoint Address and General Attributes 


@ Please specify Address Expression Hy 
Paar o ttt RRy 
eee By 
Select debug target for target-specific information 
@ PPC7SOFX 
None - preserve current settings 


“9 General Status Scope @ Hardware 


Address Expression | | 7 


(_] Continue on Break 


Continue Delay (ms) | 


Cancel 


You can use data hardware breakpoints to find out which routines are modifying 
a specific variable. 


The Address Expression can be a symbol or a specific address in hex. You can use 
the address 0x0 in the Address Expression field to set a data hardware breakpoint 
to catch null pointers. You can set the Address Expression field to an address in 
the stack area to set a data hardware breakpoint to find out if the stack grew to that 
point. 


The following example sets a symbol in the Address Expression field. 
1. Click Browse. 


The Select Symbol dialog appears, showing a list of available symbols that can 
take a hardware breakpoint. 
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Figure 9-16 Select Symbol 


% Select a symbol 


Choose the symbol from the list. Debug symbols can only be 
retrieved if there is an active debug session 


Debug target 
@ PPC7SOFX 


Filter (regular expression) 


Matching symbols 


® send_month - globalfunction 
® SeniorTestEngineer - globalyariable 
status - globalyariable 

strcmp - globalfunction 

strcpy - globalfunction 
swapCells - globalfunction 
test_engineer - globalyariable 
testBits - globalyariable 
TestEngineer - globalvariable 
wait_count - globalvariable 
wait_index - globalvariable 
year 1997 - globalvariable 


Cancel 


2. Scroll down and highlight the symbol wait_index. 
3. Click OK. 


The global variable wait_index is now the address for the data hardware 
breakpoint. 


The hardware breakpoint on wait_index appears in the Breakpoints view. 
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Figure 9-17 wait_index 


“= Breakpoints * 


In the Debug view, click Resume. 


The program runs until it hits the hardware breakpoint. Workbench halts the 
processor when it locates wait_index and displays that source line in the Editor. 
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Figure 9-18 Hardware Breakpoint Hit 


iC) cdemo.c 58 [C) strutils.c | {C) calendar.c 2) =O] $F Debug 2% - >is 
a od 
globalLongl = calendar( localLongl }; o> Nw 2@& & eo 
, 2 8B 
+ ft i f 
q.a = 55; 


i ate = & WRProbe_PPC?50Fx [Attach to Target] 
strepy(q.b,"December") ; lw? PPC7SOFX (System Made) 

q.c = 12345678L; =) #4) System Context (Stopped - Breakpoi 
q.color = red; =" main() - cdemo.c:195 


=" diabasm.s:58 


sum = 0; 
> wait_index = 0; 
wait_count = 5; < il | > 
quick index = 5; / = —s 
= |®o Breakpoints 53 7 7 | 9 
recordvar.color = red; 4 x 7) €@#o: x. | Fea & A 
ng 3 [¥] % wait_index (*Planted*, Restricted Scope} 
e * 


while (wait_index < wait_count) 
{ 


wait_index = addone(wait_index); v 
a il | P| : 
Tasks Problems | Properties | Build Console | 4 OCD Command Shell £3 % > ial 
[Connected to PPC7SOFX] > o eZ w & w po) > | 
TBREAK! = [MWSGIZUUU] SOItware Hreakpoint; PU = UXUUUL: © 
>BKM> | 
“an one 
x! 
P-RUN> ox0001CF80 
>BKM>go Ox00015F8E 
>RUN>ha Ox00014FE0 
>BKM>go Ox008ES6DC 
>RUN> oxo00000000 
>BEM> Ox3FFOOEA7 
>RUN> : Ox24F27DB6 
= 0x00000011 
, 0x00000000 
'BREAK! -— [msg11001] Internal hardware breakpoint; PC Ox00BC614E 
>BKM> __] Ox00000000 
>BKM> Mi 0x0001D25C 
cy > 


9.5.7 Disconnecting and Terminating Processes 


Disconnecting from a process or core detaches the debugger, but leaves the process 
or core in its current state. 


Terminating a process actually kills the process on the target. 
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NOTE: If the selected target supports terminating individual threads, you can 


select a thread and terminate only that thread. 
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10.6 Flash Memory/Diagnostics Tab 78 


10.1 Introduction 


In order to erase and program target flash memory, you must first set up your 
target registers properly, as described in 6. Board Initialization. 


The Flash Programmer view provides the ability to flash images into flash chips 
present on your target. 


To program flash correctly you need to know the physical characteristics of your 
flash bank. For instance, your target may have one flash device connected to a 
64-bit bus. Or it may have a bank of several flash devices, for example two flash 
devices, each wired at 16 bits, connected along a 32-bit bus. If you are using a Wind 
River-supported target, this information can be found in the file 


installDirlvxworks-6.x/target/config/yourTarget/target.ref 
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If you are not using a Wind River-supported target, consult your target’s 
documentation. The design primitives of your target board should be included in 
its board specification and schematics. 


10.2 Testing Flash Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download, and breakpoints, which are 
used to stop an erase and program operation at completion. 


Reading and Writing Memory 


Once you have established communications with the target, use the following 
procedure to make sure you can write to and read from the target. In this example 
we assume that the RAM workspace is 0x00F00200. 


NOTE: A RAM workspace address of 0x00F00200 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your target’s target.ref file, located in 
installDir/vxworks-6.x/target/config/yourTarget/target.ref. 


Wherever the RAM workspace is located on your target, you must make sure that 
memory is writable there. 


At the >BKM> prompt, enter dm 00F00200 and press ENTER. Doing so displays the 
memory on your target at address 0. 


Next, enter sm 00F00200 1234 and press ENTER to set the memory at address 0 to 
the value 1234. Enter dm 00F00200 to display the memory at that address again. 


If you are communicating properly with your target, output is similar to that 
shown below: 


>BKM>dm 00£00200 

OOFO0200: FF7C EFFE FEFF E3FE 0D01 OFBE FOFD BFB6 . | sah aclornat Si eth ta arses atse Se 
>BKM>sm 00£00200 1234 

>BKM>dm 00£00200 

OOFO0200: 1234 EFFE FEFF E3FE O0D01 OFBE FOFD BFB6 .4............. 
>BKM> 
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Occasionally, you may have difficulty programming flash memory on your target 
if software breakpoints are not being hit properly. Test this functionality before you 
continue. 


To use the test, enter the following commands at the >BKM> prompt in the OCD 
Command Shell: 


>BKM>df e 0 


>BKM>di 0 6 


$00000000 : 0x60000000 :ppc nop 
$00000004 : 0x60000000 :ppc nop 
$00000008 : 0x60000000 :ppc nop 
$0000000C : 0x60000000 :ppc nop 
$00000010 : Ox7COOO04AC :ppc sync 
$00000014 : OxX4BFFFFFO :ppc b 0x4 
>BKM>go 0 
>RUN>dr pe 
PC = 00000004 
>RUN>dr pe 
PC = 00000010 
>RUN>sb 8 
>RUN> 
!BREAK! - [msg12000] Software breakpoint; PC = 0x00000008 [EVENT Taken] 
>BKM> 
>BKM>rb 
>BKM> 


10.3 Getting Started 


Once you have connected to Wind River Workbench, as described in your 
emulator’s Hardware Reference, and configured your target registers, as described 
in 6. Board Initialization, you are ready to begin programming flash. 


1. Inthe toolbar, click on Window, then select Show View > Flash Programmer. 
The Flash Programmer view appears. 


The Flash Programmer view has three tabs: Configuration, Programming, and 
Memory/Diagnostics. Use these tabs to configure your flash address and RAM 
workspace, choose files for download, execute erase and program operations, and 
check the results of your operations. 


69 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for PowerPC, 2.6.1 


10.4 Flash Configuration Tab 


Use the Configuration tab to configure the base address and workspace address 
for flash memory erase operations. You can also enter the physical description of 
your flash devices. 


Figure 10-1 Configuration Tab 


Error Log Tasks Problems Properties Build Console OCD Command Shell MeQNsrenlspes iui atas Terminal 0 


Configuration | Programming | Memory/Diagnastics 
Device Selection Configuration 
Current: Flash Bank Addresses 
Base: | Oxe0000000 | Last: 


| = aMD 


w 29LVO04T RAM Workspace 
fH 29LY004B 


H 29LVOOBBT | start: | ox00F00200 | End: 


(# 29LYO08BB Size: 392 —SOtC«C 

(4) 29F010 

- 29F040 

(=. 29F080/81 

(=) 1024x 8 

1 Device 
2 Devices 
SetjEdit Timeouts 
8 Devices Program: 

(#) 29F016/17 

 29F032/33 


Erase: 


10.4.1 Selecting a Flash Driver 


In the Device Selection field, browse to a description of your flash bank. 
Figure 10-1 shows an example of a flash bank consisting of four 8-bit AMD 29F0808 
devices. 


NOTE: For AMD flash devices, “F” and “LV” devices are interchangeable in 
Workbench. 


If you attempt to move on to the Programming tab without selecting a flash bank 
description in the Configuration tab, Workbench displays an Invalid Flash Bank 
error and returns you to the Configuration tab. 
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10.4.2 Configuring Flash Memory Bounds 


In the Configuration field, enter the Base value for the area of flash memory you 
wish to erase. In Figure 10-1 the address used is 0xe0000000. The Last field 
populates automatically. 


NOTE: Workbench erases flash memory sector by sector. That means that no matter 
where the address you enter in the Base field is located within the flash sector, 
Workbench will still erase the entire sector. 


If Workbench detects that the address you entered in the Base field is not correctly 
aligned with the flash sector boundary, it displays the following warning message: 


Figure 10-2 Incorrect Flash Base Address 


WARNING - Incorrect Flash Base Address 


A Incorrect address; OxfFFFFFFF 


The base address you entered for your flash is incorrect. 
This address must be aligned on a boundary of 0x100000 


Clicking ‘Align’ will align your flash base address correctly For you, 
Clicking ‘Cancel will take you back to the configuration tab so that you can re-enter the base address manually, 


Clicking ‘Continue’ will allow you to use the incorrectly aligned address that you have entered. 
Be aware that this option could cause undetermined behavior while using the flash utility and is not recommended. 


* To have Workbench align your base address, click Align. Workbench aligns the 
base address with the nearest preceding sector boundary. 


* To go back to the Configuration tab and re-enter the address manually, click 
Cancel. 


« To use the base address as you entered it, without aligning it with the flash 
boundary, click Continue. 
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uN CAUTION: Choosing Continue may cause unpredictable results in your flash 
programming operations. Wind River recommends that you align the base 
address with the flash sector boundary. 


10.4.3 Configuring Flash Memory Bounds 


In the Configuration field, enter the Base value for the area of flash memory you 
wish to erase. In Figure 10-1 the address used is 0xe0000000. The Last field 
populates automatically. 


NOTE: Workbench erases flash memory sector by sector. That means that no matter 
where the address you enter in the Base field is located within the flash sector, 
Workbench will still erase the entire sector. 


10.4.4 Configuring RAM Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download. 


In the RAM Workspace field, enter the Start value for the area of RAM you wish 
to use as the workspace. In the Size field, enter the desired size of the workspace 
in bytes. In Figure 10-1 the starting address used is 0x00F00200 and the workspace 
size is 3992. The End field populates automatically. 


NOTE: A RAM workspace address of 0x00000000 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your processor’s target.ref file, located in 
installDir/vxworks-6.x/target/config/yourTargetBoard/target.ref, or target.ref.linux 
file, located at http://www.windriver.com/support. 


10.4.5 Setting Timeouts 
To set a program or erase timeout, use the Program or Erase fields in the Set/Edit 


Timeouts area. Enter a timeout value in seconds. If you enter an invalid number, 
Workbench resets the timeout to its default setting. 
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10.5 Flash Programming Tab 


Figure 10-3 


Use the Programming tab to execute erase and program operations in flash and to 
specify files for download. 


Programming Tab 


Error Log | Tasks Problems Properties Build Console OCD Command Shell WaQiisesntar lyme ata’ Terminal 0 
Configuration | Programming | Memory/Diagnostics | 


Flash Programming Erase Sector Selection 
[_]Send "IN" before each operation 


[Enable pre-Flash | 
[Enable post-flash | 


Erase Program Erase/Program Verify Abort 


(J Override erase sector selection 


+ 


Sector 

Oxe0000000 
Oxe0040000 
Oxe0080000 
Oxe00c0000 
Oxe0100000 
Oxe0140000 
Oxe0180000 
Oxe01c0000 
Lower boundary address [oxeno00000 | pisahacphte 
Upper boundary address [ | Oxe0280000 
Oxe02c0000 
Oxe0300000 
Oxe0340000 
Oxe0380000 
Oxe03c0000 


Select all Clear all 


WOUYANHEWONHKO 


Add/Remove Files 


Status File Path Start Addr... End Address Enabled 


10.5.1 Erasing and Programming Flash 


To issue an IN initialization command before erase or program operations, select 
the Send “IN” before each operation checkbox. 


Click Erase to erase the contents of the flash memory sectors you selected in the 
Configuration tab. 


Click Program to program the flash memory with the files you selected in the 
Add/Remove Files area of the Programming tab. 


Click Erase/Program to perform both operations. Workbench will erase all selected 
flash sectors before programming. 


Click Abort to stop the erase or program operation. 
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10.5.2 Verifying Flash Contents 


Click Verify to execute a byte-by-byte comparison between the file you just 
downloaded and the file already in memory. If there is a discrepancy, Workbench 
will break at that address and deliver an error message. 


10.5.3 Running a Pre- or Post-Flash Script 


You can specify a script to run before or after an erase or program operation. Select 
the Enable pre-flash or Enable post-flash checkboxes (you can select either or 
both for any operation). Next to the checkbox, click Browse and navigate to the 
script you wish to run. 


10.5.4 Selecting Flash Sectors for Erasure 


The Sectors field automatically populates with the starting addresses of sectors of 
flash memory, depending on which flash device you specified in the 
Configuration tab. Click on a sector to select it. You can select all sectors by 
clicking Select All. Click Clear All to deselect all sectors. 


Before you erase all sectors, make sure you know what resides in the flash. For 
example, PowerPC 82xx processors read their reset configuration word from 
FE000000 out of the flash device, so for 82xx processors, erasing the entire device 
may cause problems with resetting the board. 


10.5.5 Manually Configuring Flash Memory Erasure Bounds 


Workbench allows greater user control by allowing manual configuration of the 
flash memory bounds for erase operations. 


You can manually configure the flash memory bounds by checking the Override 

erase sector selection checkbox. When this box is checked, Workbench will allow 
you to enter any addresses in the Lower boundary address and Upper boundary 
address fields. 


NOTE: If the values you enter result in a memory address range that is outside 
your target board’s flash programming area, erase operations will not perform 
correctly. 
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10.5.6 Adding Files 


To add a .bin file, click Add File. This opens the Choose File for Flash Download 
browser window. Workbench automatically looks for a folder labeled firmware, 
located in installDir!workbench-2.x/dfw/version/host/firmware, where version is 
the installed version of the debugger middleware. If your .bin files are stored in 
another folder, use the browser to navigate to it. Select the file you want and click 
Open. The file will appear in the File Path field. 


10.5.7 Removing Files 


To remove a file from the list, highlight it and then click Remove File. 


10.5.8 Converting Files To Wind River Flash Binary Format 


In order to use a file to program flash, you must convert it to a Wind River binary 
format that the Flash Programmer can use. Workbench can convert any of the 
following file types to Wind River binary format: 


« elf files 

« hex files 

« — srec files 

«any headerless flat binary (RAWBIN) file 


To convert a file to Wind River binary format, use the following steps: 
1. Inthe Programming tab, select Convert File. 


2. Inthe browser window that opens, navigate to the file you want to convert and 
click Open. 


The Convert utility appears. 
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File Conversion utility 


File path 
Input path: — c:\bitbucket\cdemo. elf This is a raw binary file 


Output path: | c:jpitbucket\edemo.bin 


Conversion output 
Address information 


Start: | oxd0000000 
End: | OxftFFFFff 


Convert File 
Convert and Add File 


Converting the file to Wind River binary format does not delete the original 
file. 


By default, Workbench stores the new binary file in the same location as the 
original file. If you want the new binary file stored somewhere else, enter the 
path to the desired location in the Output path field. 


3. Select Convert and Add File. 


Workbench converts the selected file to Wind River binary format and adds it 
to the file list in the Programming tab. 
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File Conversion utility 


File path 
Input path: | c:\bitbucket\cdemo.elF | (This is a raw binary File 
Output path: | c;\bitbucket\cdemo.bin 


Conversion output 


Address information convert v7.11G Copyright (c) 1996-2006 Wind River HSI 

. ] convert ELF file C:\bitbucket\cdemo.elf to Flat Binary File C:\bitbucket\cdemo.bin 
Settiy| OXO0000000 Extracting image From 'C:\bitbucket\cdemo. elf 
End: | oxffffrrFe Writing flat binary image to 'C;\bitbucket\cdemo. bin’ 

——— = Lower address: 0x0 

\Upper address: OxfFFFFFFF 
Execution address: 0x00000400 
[Image written 
Processing time: 0.000 seconds 


Convert File 
Convert and Add File 


NOTE: To convert the selected file to Wind River binary format without adding 
it to the file list in the Programming tab, select Convert File. 


4. Click OK. 


You are returned to the Programming tab. The file you just converted now 
appears in the File Path field. 


10.5.9 Setting The Download Offset Of A File 


In some cases, before you program the file into flash, you may need to set a 
memory offset bias to divert the data to other areas of the flash bank. 


Each file is built with a start address. This start address may or may not be the 
address where you want the image to reside on the board. If you subtract the start 
address of the image from the address where you want the image to reside on the 
board, then you end up with the proper bias address. 
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For example, if the image was built with a start address of 0x00 and you wanted 
the image to reside at the reset vector 0OxFFF00100, then the offset bias would be 
FFF00100. 


You can use the Add/Remove Files area to edit the starting address of a .bin file to 
offset the file into flash. Click on the value under the Start Address heading to 
highlight it. Edit the value as needed. 


10.5.10 Enabling A File For Download 
Enable a file by clicking on the checkbox under the Enabled heading. If the file 
address is outside your specified address range, an error message appears: 


Cannot enable for download. 
Part of this file falls outside your flash address range. 


To correct this error, you must either change the start address of your file or use the 
Configuration tab to change your flash address range. 


10.6 Flash Memory/Diagnostics Tab 


Use the Memory/Diagnostics tab to view the contents of flash memory and to run 
diagnostic tests to verify your ability to write and erase flash. 


You must set up the Configuration tab before using the Memory/Diagnostics tab. 
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Figure 10-4 Memory/Diagnostics Tab 


Programming | Add/Remove Files | Configuration Memory/Diagnostics | 


View address: | oxffrooooo Program | Erase | Abort 
jaddress  [o [1 [2 [3 [4 [5s [6 [7 [e Jo Ja [eB fc [> Je [r Jascrz = 
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FFFOOO30 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 #74 75 76 ghijklmnopqr 
FFFOOO40 77° #78 #79 7k 21 40 23 24 25 SE 26 2A 28 29 SF 2B wxyz!@#$%* «; 
FFFOOOSO Fre -FE! (EE FF SEF CFF) CRF EF 2EE: cEF ER FF SEF: cf) GEE’ EF. 
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FFFOOO70 4A 55 66 99 AA 5S 66 99 AA SS 66 99 AA S55 66 99 ut wut wut 
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FFFOOOAO AA SS 66 99 AA 5S 66 99 AA SS 66 99 AA 5S 66 99 ut Uf Ut 
FFFOOOBO AR 65506 66606« 99: AA CSS «(C66 «6999: |} 6AA SS (O66 C99: AA SS (C66 COD Ur UL Ut 


FFFoOOOCcCO 4h S55 66 99 AA 55 66 99 BA SS 66 99 AR SS 66 99 Ut Ut Uf 
FFFOOODO 4h 55 66 99 AA 55 66 99 BA S55 66 99 AA SS 66 99 Uf “Uf “Ut 
FFFOOOEO 4A 55 66 99 AA 5S 66 99 AA 5S 66 99 AA 55 66 99 UL “UL “UL 
FFFOOOFO aa 55 66 99 aA 55 66 99 AA’ SS 66 99 dA SS 66 99 UL “UL “UE 


~Messages 


——_ 


10.6.1 Viewing Memory 


Enter the address you wish to view in the View Address field. The area below 
displays the bit-level detail. To change the view, edit the address in the View 
Address field and click Refresh. You can also use the scrollbar on the right to scroll 
up and down from the starting address to the end address. 


10.6.2 Running Diagnostic Tests 
To test your ability to write to flash memory, click the Start Program Diagnostic 
button. This writes a bit pattern to flash. 
You may see a Target Exception message. This requires no action. 


If the write operation is successful, you should see the pattern *WRS_FLASH* 
repeated under the ASCII heading in the Memory/Diagnostics tab, as shown in 
Figure 10-5. 
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Figure 10-5 Successful Program Diagnostic 


Programming | Add/Remove Files | Configuration Memory/Diagnostics | 


View address: J oxffrooooo Refresh | Program | Erase | fe 


SF 46 4C 41 53 48 2A SF 248 57 S52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 48 2A SF 2A S? 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S7? S2 53 SF 46 4C 41 53 48 2A SF 24 5S? 52 53 *WRS_FLASH* *URS 
SF 46 4C 41 53 48 2A SF 2A 57 52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
S53 46 2A SF 2A S7 S52 S53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2k S57? S52 53 SF 46 4C 41 53 48 2A SF 24 S57? 52 53 *WRS_FLASH* *WRS 
SF 46 4C 41 53 48 2A SF 2A 57 S52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 46 2A SF 24 5S? 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S? S52 53 SF 46 4C 41 53 48 2A SF 248 S7? 52 53 *WRS_FLASH* *URS 
SF 46 4C 41 53 48 2A SF 2A 57 52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 46 2A SF 24 57 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S57? 52 53 SF 46 4C 41 53 48 2A SF 2A 57? 52 53 *WRS_FLASH*_*URS 
SF 46 4C 41 53 486 2A SF 2A S7 S2 S53 SF 46 4C 41 _FLASH* *URS_FLA 
53 48 24 SF 2A S57 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2k 57 52 53 SF 46 4C 41 53 48 2A SF 2A S57? 52 53 *WRS_FLASH*_*URS 


= 


So 


Messages 


If the write operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the write operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 


To test your ability to erase flash memory, click the Start Erase Diagnostic button. 
This will erase the selected flash sectors. 


You may see a Target Exception message. This requires no action. 


If the erase operation is successful, the selected sectors will be erased and the space 
under the ASCII heading in the Memory/Diagnostics view will be empty. 


If the erase operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the erase operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 
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Debugging in ROM 


11.1 Overview 81 
11.2 Getting Started 82 
11.3 Debugging in ROM 82 


11.1 Overview 


The procedure described in 9. Debugging in RAM uses software breakpoints. 
Software breakpoints work by replacing the destination instruction with an 
interrupt; therefore it is impossible to debug code in ROM using software 
breakpoints. 


To debug code in ROM you must use hardware breakpoints, which work by setting 
a break condition and comparing the condition with the execution stream. This 
chapter describes using Workbench to debug code in ROM with hardware 
breakpoints. 
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11.2 Getting Started 


To debug code in ROM, you must have an active target connection. 


To create an active target connection, follow the steps described in 4. OCD 
Connections. 


NOTE: You cannot use the Instruction Set Simulator to simulate debugging in 
ROM, because you must have an actual target in order to set hardware 
breakpoints. 


You do not need to have an active project to debug code in ROM. 


11.3 Debugging in ROM 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 


1. Inthe Target Manager view, right-click on your target name and select Attach 
to Core. 


The Disassembly view opens, with the Program Counter set to the start of the 
reset vector. 
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11.3 Debugging in ROM 


WRProbe_PPC7S0FX 


System Context 

> f£f00100: i Ese 
fff00104: 
ff£f00108: OxFFFOO138 
ff£f0010c: Ox1B, OxF, OxFFFO7184 
fff00110: r9,r19,0x6768 
f£f00114: £0;21,0x3139 
ff£f00118: ri,r20,0x2D32 
*fffoolic: r1,r16,0x3220 
#£f£00120: r9,r27,0x26,0xD 
ff£f00124: r2,r18,0x6976 
ff£f00128: ri8,r11,0x2053 
ff£fO012e: Ox7973 7465 
f££00130: r19,r11,0x2C20 
f£f00134: Ox16E632C 
f£f00138: ELL Fs 
fff0013ec: r4,r4,r4 
ff£f00140: r0,r4 
f£f00144: 
fff00148: r4 
ff£fO0014e: 
fff00150: r0;.20;7r0 
fff00154: sprgQ0,r0 
fff00158: sprgi,rO 
fff0015c: sprg2,r0 
fff00160: sprg3,r0 
f£f00164: r4,r4,r4 
fffto00168: 0,r4 


2. Inthe Target Manager view, select OCD Reset and Download. 
3. Select the Reset tab. 
4. Set the reset type to INN -- Reset. 
This will initialize the target, but leave the target registers as close to reset 


value as possible. 


NOTE: Because the target registers are not set, the target software watchdog 
timers are still active. This can cause some targets, such as PowerPC82xx 
targets, to drop out of background mode. 


Leave the Play register file box unchecked. 
Select the Download tab. 
Click Add Files... 


90: co -Oy “go 


In the browser window that appears, navigate to the boot ROM file for your 
target. 
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Tasks Problems Properties Error Log Terminal OCD Command Shell OCD Console * CF Options ” 


~ Reset and Download 


Since this example uses a Wind River PPMC750FX target, the boot ROM file is 
located in 
installDir/vxworks-6.x/target/config/wrPpmc750fx/bootrom_uncmp. 


Click Open. 
You are returned to the Download tab. 
Uncheck the Download checkbox. 


Make sure the Load Symbols checkbox is selected and the Verify field is set to 
None. 


Select the Instruction Pointer tab. 

Uncheck the Set instruction pointer after download checkbox. 
Select the Run Options tab. 

Make sure the Do not run checkbox is selected. 

Click Debug. 


The OCD Console view opens to show the results. 
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Testing Communications to Hardware Interface.... Passed 
Driving HRESET to be High Passed 
Driving HRESET to be Low Passed 
Waiting HRESET Low Acknowledge. coat Passed 
Attempting JTAG communication... ion Passed 
Waiting for HReset to be released.. ! Passed 
Testing for target STOP State Passed 
Comparing target CPU with CF setting te Passed 
Waiting For HRESET High Acknowledge. or Passed 
Testing JTAG Communication, Passed 
Testing JTAG Communication. ‘i Passed 
Getting value of cF mmu option .. Passed 
Attempting to restore CPU context. Passed 
Loading symbols... 

C:\WindRiver\yxworks-6, 3\target\configiwrPpmec750Fx\bootrom_uncmp Specified not to Download 
Specified not to Run 

* Reset and Download Completed * 


11 Debugging in ROM 
11.3 Debugging in ROM 


11.3.1 Stepping Through Boot Code 


In this example, the first line of the reset vector is a Load Immediate command: 
f££00100 li r2, 13 

In the Debug view, click the Step Into button. 

The Program Counter moves to the No-Operation command on the next line: 
£££00104 nop 


In the Debug view, the System Context changes to Stopped -- Step End, and the 
view updates to show the new location of the Program Counter. 


® Debug X 


o> of 22 Rk Bz 
=) &%} WRProbe_PPC?S0Fx [Attach to Target] 
El PPC750FX (System Mode) 
& a System Context (Stopped - Step End) 


=" ane 


If you have data views, such as the Watch view, Memory view, or Registers view 
open, you can see them update as you step through code. 


In the Debug view, click Step Into again. 

The Program Counter moves to the Branch and Link instruction on the next line: 
£££00108 bl OxFFF00138 

In the Debug view, click Step Into one more time. 


The branch instruction executes and the Program Counter jumps to address 
FFF00138. The Debug view updates to show the Program Counter at address 
FFFO00138. 
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® Debug X 


Oe bf 28 2% = 
S &% WRProbe_PPC?7S0F% [Attach to Target] 
=) PPC7SOFX (System Mode) 
=) co System Context (Stopped - Step End} 


ig OxfFFOO138 
Oo 


= oOxfffoo108 


11.3.2 Setting Hardware Breakpoints 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. Use the Breakpoints view to keep track of your 
breakpoints and their conditions. 


To debug in ROM you must use hardware breakpoints. The availability of 
hardware breakpoints varies by architecture. You can only set as many hardware 
breakpoints as there are debug registers available on your target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 
Breakpoint Capabilities. 


In the Disassembly view, right-click in the left ruler (the gutter) to the left of the 
Exclusive Or instruction at address FFF00150: 


f££00150 xor r0,r0,r0 


From the context menu that appears, select Add Hardware Breakpoint. 


The breakpoint appears in the Disassembly view and is displayed in the 
Breakpoints view. 
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11.3 Debugging in ROM 


*s Breakpoints 


ex Ke 


3S OxfffO01S0 (Hardware,Restricted Scope} 


In the Debug view, click the Resume button. 
The code runs until it hits the hardware breakpoint at address FFF0O0150. 
In the Debug view, the System Context changes to Stopped --Breakpoint Hit. 


® Debug X 


i Se ee 
a cc] WRProbe_PPC750Fx [Attach to Target] 
| ee PPC?SOFX (System Mode) 
= a System Context (Stopped - Breakpoint Hit) 
8 OxfFFOO150 


=" oxfffoo108 


The following message appears in the OCD Command Shell: 


>RUN> 


!BREAK! - [msg11001] Internal hardware breakpoint; PC = Oxfff00150 [EVENT 
Taken] 
>BKM> 


To remove the hardware breakpoint, double-click on the breakpoint icon in the 
Disassembly view gutter, or right-click on the breakpoint in the Breakpoints view 
and select Remove. 


87 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for PowerPC, 2.6.1 


88 


Pins Mapped to Common 
Signals 


A.1 Introduction 89 
A.2 PowerPC Processors --JTAG 90 
A.3 PowerPC Processors -- BDM 91 


A.1 Introduction 


This appendix describes mapped pins to common signals for Wind 
River-supported PowerPC processor families. 


For all families described in this appendix, “n” is set as an ACTIVE LOW. 
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A.2 PowerPC Processors -- JTAG 


Table A-1 


PowerPC -- JTAG 


Pin 

Number Function Description 

1 TDO Test Data Out 

2 nQACK Quiescent Acknowledge 
3 TDI Test Data In 

4 nTRST Test Reset (reset JTAG clock) 
5 nQREQ Quiescent Request 

6 JTAG_VIO JTAG Voltage Output 

7 TCK Test Clock 

8 CHKSTPIN Checkstop Input 

9 TMS Test Mode Select 

10 PIN10 Hardwired 

11 nSRESET Software Reset 

12 GND Ground 

13 nHRESET Hardware Reset 

14 NC Not Connected 

15 CHKSTPO Checkstop Output 

16 GND Ground 
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A.3 PowerPC Processors -- BDM 


Table A-2 


PowerPC -- BDM 


maces Function Description 

af VFLSO Visible Flash Status bit 0 
2 nSRESET Software Reset 

3 GND Ground 

4 DSCK Debug Serial Clock 

5 GND Ground 

6 VFLS1 Visible Flash Status bit 1 
7 nHRESET Hardware Reset 

8 DSDI Debug Serial Data Input 
9 BDM_VIO Voltage Input/Output 
10 DSDO Debug Serial Data Output 
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Internal Breakpoint 
Capabilities 


Emulators use breakpoints to implement single stepping, since the embedded 
processor’s single step mode, if it has one, is not useful for stepping through C 
code. 


Software breakpoints work by replacing the destination instruction by a software 
interrupt. Therefore, it is impossible to debug code in ROM using software 
breakpoints. 


Hardware breakpoints work by setting a break condition and comparing it against 
the execution stream. You can use hardware breakpoints to debug code in RAM, 
ROM, flash memory, or even unused address spaces. 


Complex breakpoints involve conditions. An example might be, “Break if the 
program writes value to variable if and only if function_name was called first.” A 
software-only debugger setting a complex breakpoint must interpret the program 
while watching for the trigger condition, which slows performance. Emulators 
implement complex breakpoints in hardware, so there is no performance penalty. 


In Wind River Workbench, you can use the Breakpoints view to keep track of all 
breakpoints, along with any conditions. 


You can create breakpoints in different ways: by double-clicking or right-clicking 
in the Editor’s left overview ruler (also known as the gutter), by opening the 
various breakpoint dialogs from the pull-down menu in the Breakpoints view 
itself, or by selecting one of the breakpoint options from the Run menu. 


Wind River Workbench supports three kinds of breakpoints: line breakpoints, 
expression breakpoints, and hardware breakpoints. 
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Line Breakpoints 


Set a line breakpoint to stop your program at a particular line of source code. 


To set a line breakpoint with an unrestricted scope (that will be hit by any process 
or task running on your target), double-click in the left gutter next to the line on 
which you want to set the breakpoint. A solid dot appears in the gutter, and the 
Breakpoints view displays the file and the line number of the breakpoint. You can 
also right-click in the gutter and select Add Global Line Breakpoint. 


To set a line breakpoint that is restricted to just one task or process, right-click in 
the Editor gutter and select Add Breakpoint for selected thread. If the selected 
thread has a color in the Debug view, a dot with the same color will appear in the 
Editor gutter, with the number of the thread inscribed inside it. 


Either of these actions opens the Line Breakpoint dialog, where you can create and 
adjust the properties of the breakpoint. 


Expression Breakpoints 


Set an expression breakpoint using any C expression that will evaluate to a 
memory address. This could be a function name, a function name plus a constant, 
a global variable, a line of assembly code, or just a memory address. Expression 
breakpoints appear in the Editor’s gutter only when you are connected to a task. 


Breakpoint conditions are evaluated after a breakpoint is triggered, in the context 
of the stopped task or process. Functions in the condition string are evaluated as 
addresses and are not executed. Other restrictions are similar to the C/C++ 
restrictions for calculating the address of a breakpoint using the Expression 
Breakpoint dialog. 


Select Add Expression Breakpoint from the pull-down menu in the Breakpoints 
view to open the Expression Breakpoint dialog, where you can create and adjust 
the properties for the breakpoint. 


Hardware Breakpoints 


Some processors provide specialized registers called debug registers that can be 
used to specify an area of memory to be monitored. For instance, [A-32 processors 
have four debug address registers, which can be used to set data breakpoints or 
control breakpoints. 
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B Internal Breakpoint Capabilities 


Hardware breakpoints are useful if you want to stop a process when a specific 
variable is written or read. For example, with hardware data breakpoints, a 
hardware trap is generated when a write or read occurs in a monitored area of 
memory. Hardware breakpoints are fast, but their availability is 
machine-dependent. On most CPUs that do support them, only four debug 
registers are provided, so you can only watch a maximum of four memory 
locations in this way. 


There are two types of hardware breakpoints: 
* A hardware data breakpoint occurs when a specific variable is read or written. 


« A hardware instruction breakpoint or code breakpoint occurs when a specific 
instruction is read for execution. 


Once a hardware breakpoint is trapped—either an instruction breakpoint or a data 
breakpoint—the debugger will behave in the same way as for a standard 
breakpoint and stop for user interaction. 


Adding Hardware Instruction Breakpoints 
There two ways to add a new hardware instruction breakpoint: 


In the gutter on the left of the source file, right-click and select Add Hardware 
Code Breakpoint. Alternately, double-click in the gutter to add a standard 
breakpoint and then, in the Breakpoints view, right-click the breakpoint you just 
added and select Properties. In the last pane (Hardware) of the Properties dialog, 
select Enable Hardware Breakpoint. 


Adding Hardware Data Breakpoints 


Set a hardware data breakpoint when: 


« The debugger should break when an event (such as a read or write of a specific 
memory address) or a situation (such as data at one address matching data at 
another address) occurs. 


« Threads are interfering with each other, or memory is being accessed 
improperly, or whenever the sequence or timing of runtime events is critical 
(hardware breakpoints are faster than software breakpoints). 


Select Add Data Breakpoint from the pull-down menu in the Breakpoints to open 
the Hardware Data Breakpoint dialog, where you can create and adjust the 
properties for the breakpoint. 
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Converting Line or Expression Breakpoints Into Hardware Code Breakpoints 


To cause the debugger to request that a line or expression breakpoint be a 
hardware code breakpoint, select the Hardware check box on the Hardware tab of 
the Line Breakpoint or Expression Breakpoint dialog. 


This request does not guarantee that the hardware code breakpoint will be planted; 
that depends on whether the target supports hardware breakpoints, and if so, 
whether or not the total number supported by the target have already been 
planted. If the target does not support hardware code breakpoints, an error 
message will appear when the debugger tries to plant the breakpoint. 


NOTE: Workbench will set only the number of code breakpoints, with the specific 
capabilities, supported by your hardware. 


NOTE: If you create a breakpoint on a line that does not have any corresponding 
code, the debugger will plant the breakpoint on the next line that does have code. 
The breakpoint will appear on the new line in the Editor gutter. In the Breakpoints 
view, the original line number will appear, with the new line number in square 
brackets [] after it. 


Importing Breakpoints 


To import breakpoint properties from a file: 


1. Select File > Import > Import Breakpoints, then click Next. The Import 
Breakpoints dialog appears. 


2. Select the breakpoint file you want to import, then click Next. The Select 
Breakpoints dialog appears. 


3. Select one or more breakpoints to import, then click Finish. The breakpoint 
information will appear in the Breakpoints view, and the next time the context 
for that breakpoint is active in the Debug view, the breakpoint will be planted. 


Exporting Breakpoints 


To export breakpoint properties to a file: 
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1. Select File > Export > Export Breakpoints, then click Next. The Export 
Breakpoints dialog appears. 


2. Select the breakpoint whose properties you want to export, and type ina file 
name for the exported file. Click Finish. 


Refreshing Breakpoints 


Right-click a breakpoint in the Breakpoints view and select Refresh Breakpoint to 
cause the breakpoint to be removed and reinserted on the target. This is useful if 
something has changed on the target (for example, you downloaded a new 
module) and the breakpoint is not automatically updated. 


To refresh all breakpoints in this way, select Refresh All Breakpoints from the 
pull-down menu in the Breakpoints view. 


Disabling Breakpoints 
To disable a breakpoint, clear its check box in the Breakpoints view. This retains all 
breakpoint properties, but ensures that it will not stop the running process. To 
re-enable the breakpoint, select the box again. 

Removing Breakpoints 


To remove a breakpoint: 


« Right-click on a breakpoint in the Editor gutter and select Remove 
Breakpoint. 


« Select a breakpoint in the Breakpoints view and select Remove. 
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C.1 JTAG Pin Terminations 


C.1.1 16-Pin JTAG Connector | 


The following processors use this pinout: 


= PowerPC5xxx 
» PowerPC 55xx 
"=  PowerPC6xx 

»  PowerPC7xx 

»  PowerPC74xx 
»  PowerPC82xx 
» PowerPC83xx 
»  PowerPC85xx 
» PowerPC86xx 
= PowerPC9xx 


The connector type on your board should be as follows: 
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"16 (2 by 8) 0.025" square posts 

» 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSW-108-07-S-D. 


Figure C-1 shows the pinouts for this connector. 


Figure C-1 16-pin JTAG Connector Pinouts 


TDO 1] 2NC 
TDL 3 A IRST 
(QREQ 5 6 EXPSENSE 
TCK 7 8 NC 
TMS 9 10 NIC 
SRESET 11 12 GND 
/HRESET 13 14 NC 
{CHKSTPO 15 16 GND 


The following table contains the Wind River-recommended pull-up/ pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 


Table C-1 16-pin Connector JTAG Terminations 


Signal Name Description 
TRST External 4.7K pull-up 
EXPSENSE External 1K pull-up 
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C Pin Terminations 
C.1 JTAG Pin Terminations 


NOTE: These are the termination values for the Wind River reference design. It is 


important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are working with. 


C.1.2 16-Pin JTAG Connector Il 


The following processors use this pinout: 


» AMCC 40x 
» AMCC 44x 


The connector type on your board should be as follows: 
"16 (2 by 8) 0.025" square posts 

» 0.10" between centers of adjacent posts 

* 0.23" height of each post 

A sample connector is Samtec part number TSW-108-07-S-D. 


Figure C-2 shows the pinouts for this connector. 
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Figure C-2.  16-Pin JTAG Connector for AMCC 40x and 44x 


TDO 1 2NC 
TD 8 4 fTRST 
NC 5 6 PWR 
sense 
TOK 7 & NC 
TMS 9 10 Nic 
{HALT 11 12 NC 
NMC 13 14 KEY 
NC 15 16 GND 


Newer processors may not be 3.3v or 5v tolerant. 


Board designers will provide the correct I/O voltage to use with these processors 
through the PWR Sense pin (pin 6). Debugger hardware connections to the debug 
port should adjust their output voltage levels based on the PWR Sense pin. If the 
PWR Sense pin indicates 1.8v, then the levels of TCK, TMS, TDI, TRST and HALT 
should not exceed 1.8v. The same applies for input pins like TDO. The debugger 
hardware should be able to differentiate between high and low even when the high 
level may only be 1.8v. 


The maximum allowed value of TCK is half the core speed. A 50MHz processor 
should not be clocked with TCK greater than 25MHz. 


The following table contains the Wind River-recommended pull-up/pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 
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C.2 BDM Pin Terminations 


Table C-2 16-pin Connector JTAG Terminations 


Signal Name Description 


TRST External 4.7K pull-up 


AMCC 40x and 44x processors can also use 38-pin Mictor connectors to combine 
run control and trace control. See C.3 Mictor Pin Terminations, p.105. 


C.2 BDM Pin Terminations 


C.2.1 PowerPC 5xx/8xx 10-pin BDM Connector 


The connector type on your board should be as follows: 

* 10 (2 by 5) 0.025" square posts 

» 0.10" between centers of adjacent posts 

» 0.23" height of each post 

A sample connector is Samtec part number TSW-105-07-S-D. 


Figure C-3 shows the pinouts for this connector. 
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Figure C-3 10-pin BDM Connector Pinouts 


IPBO/MMPOVFLSO 1 2 /SRESET 
SND 3 4 DSCK/ICK 
GND 5 6 |IP_BI/MPI/VFLS1 
fHRESET 7 8 DSDIADI 
3.3V 9 10 DSDOQIDO 


The following table contains the Wind River-recommended pull-up/pull-down 
resistor values that must be placed on the target. Signals not shown should not 
have pull-ups or pull-downs. 


Table C-3 PowerPC 5xx/8xx BDM Terminations 


Signal Name Description 
DSCK/TCK External 10K pull-down 
DSDI External 10K pull-down 


NOTE: These are the termination values for the Wind River reference design. It is 
important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are working with. 
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C.3 Mictor Pin Terminations 


Table C-4 


The AMCC 40x and 44x processors use a 38-pin Mictor connector when connected 
to the Wind River Trace. The Mictor connector can also be used for run control. 


The recommended manufacturer’s part number for this 38-pin Mictor connector is 
part number AMP 2-767004-2. 


No terminations are required for any of the trace signal pins. For JTAG 
terminations, the following table contains the Wind River-recommended 
pull-up/ pull-down resistor values that must be placed on the target. Signals not 
shown should not have pull-ups or pull-downs. 


16-pin Connector JTAG Terminations 


Signal Name Description 


TRST External 4.7K pull-up 


NOTE: These are the termination values for the Wind River reference design. It is 


important that you verify that the pull-up and pull-down values you use are 
appropriate for the board that you are working with. 
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C.3.1 AMCC 403 38-pin Mictor Connector Pin-out 


This connector’s pin-out information for the AMCC 403 processor is shown in 


Figure C-4. 
Figure C-4 AMCC 403 38-pin Mictor Connector 
NIC 1 2N/C 
NIC 3 ANC 
N/C 5 6 TRCCLK 
{HALT 7 BN/C 
N/C 9 10 N/C 
TODO 11 12 VREF 
MIC 15 14. N70 
TCK 15 16 NIC 
TMS 17 18N/C 
TDI 19 20 N/C 
NAC 21 22N/C 
NAC 25 24N/C 
NYC 25 26 T50 
NC 27 26751 
M/C 29 30 TS2 
NYC 31 32733 
NIC 35 34 T54 
NYC 35 36 TS5 
NYC 35 36 156 
na 
oaaa 
5556 
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C Pin Terminations 
C.3 Mictor Pin Terminations 


C.3.2 AMCC 405 38-pin Mictor Connector Pin-out 


This connector’s pin-out information for the AMCC 405 processor is shown in 
Figure C-5. 


Figure C-5 AMCC 405 38-Pin Mictor Connector 


NIC 1 2N/C 
N/C 3 4N/C 
NIC 5 6 TRCCLK 
{HALT 7 BNC 
NIC 9 1ON/C 
TOO 11 12 VREF 
MIC 13 14 NIC 
TCK 15 16N/C 
TMS 17 18 N/C 
TD! 19 20 N/C 
/TRST 21 22N/C 
NIC 23 247510 
NAC 25 26 T520 
NIC 2? 26 TS1E 
M/C 29 30 TS2E 
N/C 31 32 TS3 
MIC 33 34 T54 
N/C 35 36 TS5 
N/C 35 38 T56 
mB So 
oaaa 
666 6 
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This connector’s pin-out information for the AMCC 44x processor is shown in 


Figure C-6. 


Figure C-6 AMCC 440 38-Pin Mictor Connector 


C.3.3 AMCC 44x 38-pin Mictor Connector Pin-out 


MIC 1 
N/C 3 
N/C 5 
{HALT 7 
N/C 9 
TDO 11 
NMC 13 
TCK 16 
TMS 17 
TDI 19 
/TRST 21 
NIC 23 
BSO 25 
BS1 2? 
BS2 29 
ESO 31 
ES1 33 
ES2 35 
ESS 35 
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GND 39 
GND 40 
GND 41 
GND 42 


2 N/C 
4N/C 

6 TRCCLK 
BNC 
10 NC 
12 VREF 
14 N/C 
16N/C 
18 NC 
20 N/C 
22 NIC 
24 ES4 
26 TS0 
26751 
30 T52 
32733 
34 T54 
36 TS5 
36 T56 


Numerics 


38-pin Mictor Connector Pin-out 106, 107, 108 


A 


Adding Hardware Data Breakpoints 95 
Adding Hardware Instruction Breakpoints 95 
Address Bus Test 36 

Attempting JTAG communication 23 
Attempting to Locate IMMR register 24 
Attempting to restore CPU context 25 


Background Mode 22 
BDM Pin Terminations 103 
BDM Processors 91 
Bit-Level Detail 29 
Board Bring-Up 7 
Board Initialization 21 
breakpoints 

verifying with target 69 
Breakpoints view 86 
Bus Tests 36 


Index 


Cc 


Clock Rate 16 

Comparing Target CPU With CF Setting 24 

Configuring Registers Manually 28 

Converting Files To .bin Format 75 

Converting Line or Expression Breakpoints Into 
Hardware Code Breakpoints 96 

CPU Reset Type 18 

CRC Calculation 35 

Creating a Project 48 

Creating a Target Connection 10, 47 


D 


Data Bus Test 36 
Debug Connections 9 
debugger 
disconnecting and terminating processes 65 
Debugging Code in RAM 56 
Debugging in RAM 47 
Debugging in ROM 81, 82 
Diagnostic Functions 32 
Disabling Breakpoints 97 
Disconnecting and Terminating Processes 65 
Downloading a Register File 26 
Downloading Code and Symbol Information 53 
Drive TRESET Line 17 


109 


Wind River Workbench for On-Chip Debugging 


Board Bring-Up Guide for PowerPC, 2.6.1 


Driving HRESET to be High 23 
Driving HRESET tobe Low 23 


E 


Emulator HRESET Control 18 


Enabling and Disabling Register Groups 27 


Exporting Breakpoints 96 
Expression Breakpoints 94 


F 


Flash Programmer view 73 
Configuration tab 70 
getting started 69 
Memory/Diagnostics tab 78 

Flash programming 
erasing flash 73 
setting timeouts 72 
verifying flash contents 74 

Full RAM Tests 34 


G 


Goals and Objectives 7 


H 


Hardware Breakpoints 94 


Importing Breakpoints 96 
Internal Breakpoint Capabilities 93 
Introduction 1, 15, 21, 31, 37, 67, 89 


110 


J 


JTAG Pin Terminations 99 


L 


Line Breakpoints 94 
Loading Internal Registers 24 


M 


Monitor Target Reset 17 
Monitoring Processes 57 


N 


New Connection Wizard 11 


O 


OCD Connections 9 
On-Chip Debugging 3 
Overview 47,81 


P 


Pin Terminations 99 
Pins Mapped to Common Signals 89 
PowerPC 5xx/8xx 10-pin BDM Connector 
PowerPC Processors --JTAG 90 
processes 

disconnecting debugger 65 
Programming Flash Memory 67 


103 


Index 


R V 


Read From Location 35 Verifying Hardware 31 
Reading and Writing Memory 68 
Refreshing Breakpoints 97 
register groups 
disabling 27 Ww 
enabling 27 
Registers 25 
Registers view 28 
Removing Breakpoints 97 
Running a Program 59 
Running Code 40 


Waiting for HRESET to be Released 23 
Workbench 
views 
Breakpoints 86 
Write and Complement 36 
Write Rotating Value 36 
Write Then Read 36 
Write To Location 35 


S 


Saving Changes 19 

Scope Tests 35 

Set Verbose On 22 

Setting a Workspace 31 

Setting Breakpoints 86 

Setting Hardware Breakpoints 43 
Setting Software Breakpoints 41 
Setting Up a Project 82 

Simple RAM Test 32 

Stepping an Instruction 38 
Stepping Through a Program 60 


T 


target 

software breakpoints, verifying 69 
Testing Communications to Hardware Interface 23 
Testing Flash Workspace 68 
Testing for target STOP State 24 
Testing JTAG Communication 24 
Testing Memory 37 
The INCommand 22 
The INN Command 25 
The Registers View 28 
Tool Configuration 15, 16 


171 


